# Sixtyfour — full text > The substance of https://www.sixtyfour.ai as one document: what the > product is, the published benchmark results in full, and every article, > inline. Generated at build time from the same sources the pages use. > Generated: 2026-10-21 --- ## What Sixtyfour is Sixtyfour is an identity intelligence platform. It deploys AI research agents that investigate a person or company starting from a single identifier — an email address, a name, a phone number, a company or a domain. The agents browse the open web and the dark web, official records and unstructured sources, cross-reference what they find, and resolve it into one profile in which every claim is cited back to the record it came from. The company is Sixtyfour AI Inc., based in San Francisco and backed by Y Combinator. It is SOC 2 compliant. ### How it works 1. **Start with any identifier.** Begin with an email, name, phone number, company, or any other known data point. 2. **Agents research every source.** AI agents autonomously browse, extract, and cross-reference across the open and dark web, official records, and unstructured sources. 3. **Source-backed evidence, delivered.** Every verified source, record, and relationship is resolved into one cited intelligence profile. ### Who uses it - **Research API** — a self-serve research API that powers some of the leading data products in the world. - **Trust and safety** — sellers, hosts, and merchants at onboarding and at volume, and the rings operating behind them. - **Investigations** — threat actors, counterparties, and case subjects. One identifier to full footprint. - **Workforce identity** — candidates and contractors who cleared every verification check and still are not who they claim to be. - **Financial crime** — enhanced due diligence, adverse media, and alert triage with sourcing that holds up in an exam. Demo requests: https://www.sixtyfour.ai/demo. API documentation: https://docs.sixtyfour.ai/introduction --- ## Trust and safety Source: https://www.sixtyfour.ai/solutions/trust-and-safety Account intelligence for trust and safety teams. Traditional fraud tools capture what happens on your platform: device fingerprints, IP addresses, behavioural patterns, payment signals. They are good at catching known bad actors from shared signal networks, and they work once a pattern is established. Teams catch some operators that way, but the sophisticated ones have already built around those checks. Your tools can tell you a device showed up. They cannot tell you who is behind it. The identity behind the account exists across the entire internet, and that is where Sixtyfour looks — aliases, dark web, archived and deleted content, and cross-platform handles, rather than the IP address, device fingerprint, surface email and on-platform behaviour a platform can see by itself. ### What trust and safety teams use it for - **Financial crime and KYC/KYB** — company profiles resolved against registry, web presence, team and press signals. - **Marketplace risk and seller integrity** — a seller listing counterfeit goods usually operates on several platforms under similar handles; the agents cross-reference them. - **Workforce integrity and verification** — candidates and contractors whose submitted credentials a team cannot fully verify, checked against LinkedIn, university, GitHub and press records. - **Platform abuse** — a new account matched to a previously banned one through username, shared device fingerprint, forum activity and behavioural pattern. --- ## RECON: A benchmark for researching individuals Source: https://www.sixtyfour.ai/recon-benchmark · HUD results snapshot updated October 10, 2026. This is the snapshot date, not the date of every run. RECON measures how accurately AI systems find and verify facts about real individuals across scattered, unindexed and often conflicting sources. - 140 individuals, chosen across industries, roles and digital-footprint levels, avoiding public figures whose information is too widely indexed to stress-test the benchmark. - 514 human-verified fields. Every field was verified against a primary source with an unambiguous identity link to the person; fields relying on inference were rejected. - 23 systems evaluated. - Scoring is per-field against ground truth, judged by an LLM at 98.5% agreement with human raters. Metrics: **weighted accuracy** (correct minus wrong, divided by all fields), **accuracy** (share of fields answered correctly), **precision** (share of attempted answers that were correct), **recall** (share of the field set answered correctly). Earlier p50 latencies are historical reference only. Latency reference: June 16–17, 2026, not the HUD runs. ### Full results | # | System | Tier / provider | Weighted accuracy | Accuracy | Precision | Recall | Wrong | Earlier p50 (June 2026) | |---|---|---|---:|---:|---:|---:|---:|---:| | 1 | Sixtyfour XHigh | XHigh | 70.6% | 84.4% | 85.9% | 84.4% | 13.8% | — | | 2 | Sixtyfour High | High | 54.3% | 67.7% | 83.5% | 67.7% | 13.4% | 459s | | 3 | Sixtyfour Scout | Scout | 48.4% | 66.3% | 78.8% | 66.3% | 17.9% | — | | 4 | Sixtyfour Medium | Medium | 44.7% | 56.0% | 83.2% | 56.0% | 11.3% | 223s | | 5 | Parallel Ultra 2x | Parallel | 41.1% | 54.3% | 80.4% | 54.3% | 13.2% | 834s | | 6 | Parallel Ultra 8x | Parallel | 37.5% | 52.1% | 78.1% | 52.1% | 14.6% | 678s | | 7 | Grok 4.20 multi-agent | xAI | 36.2% | 51.6% | 77.0% | 51.6% | 15.4% | — | | 8 | Grok 4.6 | xAI | 36.0% | 50.8% | 77.4% | 50.8% | 14.8% | — | | 9 | Grok 4.3 | xAI | 30.9% | 44.9% | 76.2% | 44.9% | 14.0% | — | | 10 | Sixtyfour Low | Low | 28.8% | 49.8% | 70.3% | 49.8% | 21.0% | 230s | | 11 | Parallel Ultra | Parallel | 27.2% | 43.4% | 72.9% | 43.4% | 16.1% | 589s | | 12 | Kimi K3 (max) | Moonshot | 27.0% | 36.0% | 80.1% | 36.0% | 8.9% | — | | 13 | Claude Opus 5.5 (xhigh) | Anthropic | 26.3% | 32.9% | 83.3% | 32.9% | 6.6% | — | | 14 | GPT-6 Astra (max) | OpenAI | 25.1% | 28.0% | 90.6% | 28.0% | 2.9% | — | | 15 | Exa agent xhigh | Exa | 23.9% | 37.7% | 73.2% | 37.7% | 13.8% | — | | 16 | GPT-6.1-sol max | OpenAI | 23.0% | 27.8% | 85.1% | 27.8% | 4.9% | — | | 17 | GPT-5.6-sol xhigh | OpenAI | 20.4% | 31.3% | 74.2% | 31.3% | 10.9% | — | | 18 | Gemini 3.1 Pro (high) | Google | 13.4% | 23.2% | 70.4% | 23.2% | 9.7% | 87s | | 19 | Claude Sonnet 5 (xhigh) | Anthropic | 12.6% | 20.0% | 73.0% | 20.0% | 7.4% | — | | 20 | DeepSeek V4 Flash (high) | DeepSeek | 12.5% | 18.7% | 75.0% | 18.7% | 6.2% | — | | 21 | DeepSeek V4 Pro (high) | DeepSeek | 12.3% | 18.9% | 74.0% | 18.9% | 6.6% | — | | 22 | GLM 5.3 (max) | Z.AI | 3.7% | 13.8% | 57.7% | 13.8% | 10.1% | — | | 23 | Claude Haiku 4.5 | Anthropic | 1.6% | 7.6% | 55.7% | 7.6% | 6.0% | — | Additional supplied results are unranked pending verification of their incomplete denominators: - Claude Opus 5: 49 correct / 39 wrong / 414 missing (502 total). - Claude Fable 5: 14 correct / 9 wrong / 421 missing (444 total). [Historical April results, on a different dataset](https://www.sixtyfour.ai/research/recon/2026-04-results.json). --- ## Articles ### How to verify a vendor before you pay them *A real supplier can be impersonated and a fake one can look real. The checks that separate them, what each one proves, why a change of bank details is the moment to stop, and what to do if the money has already gone.* Source: https://www.sixtyfour.ai/blog/how-to-verify-a-vendor Roham Mehrabi · 2026-10-16 · Trust & Safety To verify a vendor before you pay them, check two things separately: that the business is real and is the one you think you are dealing with, and that the bank account on the invoice belongs to it. The first comes from public records: the company registry, the domain the vendor emails from, the people who sign its messages and the footprint it has built up with other customers. The second comes from one step: calling the vendor on a number you already hold, not one supplied with the request, and confirming the account before any money moves. A change of bank details is the moment that call matters most. This piece takes the checks in the order an accounts payable team can run them, with what each one is evidence of and a worked example. Our guides to [KYB verification](https://www.sixtyfour.ai/blog/kyb-verification) and [shell company red flags](https://www.sixtyfour.ai/blog/shell-company-red-flags) cover deeper company research. #### Two ways a vendor payment goes wrong Vendor payment fraud takes two main shapes. The first is an impersonated vendor: the supplier is real and you owe it money, but someone gets between you and it, usually with an email asking you to pay into a new account. [UK Finance](https://www.ukfinance.org.uk/policy-and-guidance/reports/annual-fraud-report-2026), which collects fraud data from banks and payment providers, describes invoice and mandate scams as cases where the victim tries to pay a legitimate payee and the criminal convinces them to redirect the payment, including by "posing as a supplier, and claiming that the bank account details have changed". It adds that this fraud often involves "intercepting emails or compromising an email account". The second is a fake vendor, set up to collect payments for work nobody did. Sometimes it is an outsider. The US Federal Trade Commission [warns](https://www.ftc.gov/business-guidance/resources/scams-your-small-business-guide-business) that scammers "create phony invoices that look like you ordered products or services for your business". Sometimes it is an insider. In the Association of Certified Fraud Examiners' [2026 study](https://www.acfe.com/-/media/files/acfe/pdfs/rttn/2026/2026-report-to-the-nations.pdf) of 2,402 occupational fraud cases, billing schemes, a category that includes an employee who "creates a shell company and bills employer for services not actually rendered", appeared in 21 percent of cases, with a median loss of $90,000. The FBI's Internet Crime Complaint Center (IC3) [received 24,768 complaints](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) of business email compromise in 2025, with reported losses of just over $3 billion, the largest loss of any crime type after investment fraud. In the UK, invoice and mandate scams cost £41.3 million in 2025, down 4 percent on 2024, and 68 percent of those losses were on business accounts. UK Finance gives the reason AP teams will recognise: businesses "make genuine higher-value payments more regularly, making it harder to spot and stop a fraudulent one." #### Why a change of bank details is the moment to stop In an impersonation, the theft happens when the payment destination changes, because every later payment follows the new account. The Association for Financial Professionals [surveyed 465 corporate professionals](https://www.financialprofessionals.org/training-resources/resources/survey-research-economic-data/details/payments-fraud) in January 2026 about the year before. The AFP reports that about three in four organisations were affected by business email compromise in 2025, and found that fraudsters "primarily impersonate vendors or executives to request changes to payment instructions". One respondent described a scammer who "took over the email box of one of our key vendors" and sent fake invoices that were "processed in the normal way with all approval steps", while asking for a bank change "which was entered into the system before Treasury could confirm the same". The invoices named the right supplier, came from its real address and were approved at every step. Only the account was wrong. The bank account is the one detail a fraudster has to change, so it is the one detail to confirm, on a number you already hold. #### How do you verify a change of bank details? Treat every request to change where you pay a vendor as unverified until someone has confirmed it by a second route. The IC3 [advises businesses](https://www.ic3.gov/PSA/2024/PSA240911) to "use secondary channels and/or two-factor authentication to verify requests for changes in account information", and the UK's National Cyber Security Centre [recommends](https://www.ncsc.gov.uk/guidance/phishing) that "all important email requests are verified using a second type of communication". In practice: 1. Call the vendor on a number you already hold: from your vendor master file, the signed contract or an invoice you have already paid. Use none of the numbers in the email, letter or attachment that asks for the change, and if the number in your file was itself changed recently, verify that change first. 2. Ask for someone you have dealt with before, and have them confirm the old account, the new account and the reason for the change. 3. Hold any payment to the new account until the call is done, and have a second person approve the change in your system. 4. If your bank offers a check of the name on the receiving account, use it. In the UK this is Confirmation of Payee, which [Pay.UK describes](https://www.wearepay.uk/what-we-do/overlay-services/confirmation-of-payee/faqs/) as "an account name checking service designed to help reduce misdirected payments". A close match shows you the actual account name to check, and a no match advises you to contact the organisation you are trying to pay. Finance teams rate the callback highest. In the AFP's 2026 survey, 94 percent of organisations verified fund transfer requests "by calling an authorized contact at the payee organization using a phone number from official records, not from email", and 63 percent of those using it rated it very effective, the largest share for any of the eight controls the survey listed. Where the number comes from matters as much as the call. A call to a number supplied in the request confirms only that whoever wrote the request answers the phone. In another case from the same survey, someone posing as a client sent new banking details, and "AP called the number on the email to confirm the banking details." #### How do you check that a vendor is real? For a vendor you have not paid before, check the business itself before the first payment. Is it registered, and is the registration current? In the UK, Companies House gives [free details](https://www.gov.uk/get-information-about-a-company) of any company on its register, including its registered address, date of incorporation, current and resigned officers and previous names, and records a [status](https://developer-specs.company-information.service.gov.uk/companies-house-public-data-api/resources/companyprofile?v=latest) such as active, dissolved or in liquidation. In the US, companies register with a state, usually through the secretary of state's office, and the National Association of Secretaries of State [links to each state's](https://www.nass.org/business-services/corporate-registration) business registration pages and name databases. Free searches vary: Delaware's [entity search](https://icis.corp.delaware.gov/ecorp/entitysearch/namesearch.aspx) returns active and inactive entities alike and says a result "is not an indication of the current status of an entity". A certificate of status, ordered for a fee, confirms it. Check the legal name on the invoice and the bank letter against the registry's spelling. Our [KYB guide](https://www.sixtyfour.ai/blog/kyb-verification) explains why a registry match shows a filing exists and leaves open whether the business trades. Do the people exist and work there? Look up the people who sign the vendor's emails and invoices on its website, in its filings and in their professional history. In a [2022 joint advisory](https://www.ic3.gov/CSA/2022/221216.pdf), the FBI, the FDA's Office of Criminal Investigations and the US Department of Agriculture described a sugar supplier that noticed an extra letter in the email domain of a would-be buyer and "independently contacted the actual company to verify there was no employee by that name working there". The same advisory lists fraudsters "using the names of actual officers or employees of a legitimate business" among their tactics, so a real name says nothing about who wrote the email. Does it have a footprint built by other people? A trading business leaves traces it did not write itself: customers who mention it, reviews built up over years, trade association memberships, news. The joint advisory recommends verifying a new vendor's contact details "through reputable online sources like associations or business directories", and the FTC suggests searching a new company's name online with the words "scam" or "complaint" before doing business with it. Our guide to [adverse media screening](https://www.sixtyfour.ai/blog/adverse-media-screening) covers telling whether a news hit is about the vendor or a namesake. #### How do you spot a lookalike email domain? Compare the domain on every payment-related email with the domain in your vendor file, character by character. The joint advisory describes fraudulent addresses that "include extra letters or words, substitute characters", such as the number 1 for a lower-case l, "or use a different top level domain". The [IC3 adds](https://www.ic3.gov/PSA/2024/PSA240911) that you should check that "the sender's address appears to match who it is coming from". Then date the domain. For a generic domain such as .com, the public registration record includes the date the domain was created. ICANN's [Lookup tool](https://lookup.icann.org/en) reads that record through RDAP, which [replaced WHOIS](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en) as the definitive source of the data in January 2025. A supplier you have paid for years rarely starts emailing from a domain registered last week. Our guides to [finding out who owns a website](https://www.sixtyfour.ai/blog/how-to-find-out-who-owns-a-website) and [investigating an email address](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address) go further. A matching domain is still not proof. When the vendor's own mailbox is compromised, the email comes from the right address, often inside a real thread. In the AFP's 2026 survey, 39 percent of organisations said they continue to receive genuine emails that have been intercepted by fraudsters. That is why the callback comes first and the domain check second. #### What each check proves | Check | What it shows | What it leaves open | | --- | --- | --- | | Callback on a number you already hold | The vendor you know made, or did not make, the request | Whether the number in your file was changed by an earlier request | | Bank's account-name check, where offered | Whether the name on the receiving account matches the one you entered | Whether that account holder is your vendor or a namesake | | Registry record | A company with this name and number exists, with a status, an address and, where the registry lists them, its officers | Whether it trades, and whether it sent the invoice | | The named people | The people in the emails exist and work at the vendor | Whether they wrote these emails | | Email domain and its creation date | Whether the address matches your file, and how old the domain is | Whether a matching mailbox has been compromised | | Operating footprint | Other people have dealt with the business over time | Whether this request came from it | Count only independent evidence: a registry record and a website that copies its address are one fact seen twice. #### How much checking does a payment need? Set the depth by the risk. - Every change of bank details, for every vendor: a callback on a number you hold, a second approver, and an account-name check where your bank offers one, whatever the size of the payment. - Every new vendor, before the first payment: the registry record, the named contacts, and the email domain and its age. - A new vendor with a large first order, an account that does not fit it, such as one in another country, or pressure to pay quickly: the footprint and adverse media checks too, and a call on a number you found yourself. - Existing vendors: watch for change. Companies House offers [free email alerts](https://www.gov.uk/get-information-about-a-company) when a company updates its details, such as a change of director or address. #### Controls that keep the checks in place A check that depends on one person remembering it under deadline pressure will eventually be skipped. These controls make it part of the process. - Separate the people who can create vendors or change their bank details from the people who approve payments, so that one person cannot do both. - Accept no bank change on the strength of an email alone. In the AFP's 2026 survey, 96 percent of organisations had "established policies to verify changes to invoices, bank deposits and contact details", and 91 percent prohibited "payment initiation based on emails or other less secure messaging systems". - Require senior sign-off above a payment threshold. In the same survey, 94 percent of organisations did. - Hold the first payment to a changed account until the callback is done, and consider a short hold after that too, so that the real vendor would notice a missing payment before much money moves. - Tell your vendors how you handle changes. The NCSC suggests telling suppliers and customers what to look out for, with messages such as "our bank details will not change at any point". A buyer can tell its vendors that every change to their bank details will be confirmed by a call to the number on file. Genuine vendors then expect the call, and pressure to skip it stands out. #### A worked example The case is a composite. Kemberwick Packaging is invented, its domains use the .example names [reserved for documentation](https://www.rfc-editor.org/rfc/rfc2606), and its phone numbers come from the 555-0100 to 555-0199 range reserved for fictional use. A food manufacturer in Ohio has bought corrugated boxes from Kemberwick Packaging for six years, paying by wire to the same account. In September 2026 its AP team receives an email from Kemberwick's accounts team about two open invoices totalling $184,000. It quotes real earlier messages, is signed with the name of Kemberwick's real finance manager, and says Kemberwick has moved its banking. An attached letter on Kemberwick letterhead gives a new account at a different bank, in another country, and asks for payment by Friday. The domain. The email comes from accounts@kernberwick.example. The vendor file says kemberwick.example. Read quickly, rn passes for m. An RDAP lookup shows the lookalike domain was created eight days earlier. The quoted thread is genuine, so whoever sent the email has read the real correspondence, most likely through a compromised mailbox at one end. The people. The finance manager named in the signature appears on Kemberwick's website. The name is real, which shows the sender knows whom to impersonate and nothing more. The phone number. The signature gives a direct line, +1 614 555 0182. The vendor file holds Kemberwick's main number, +1 614 555 0137, taken from the contract. The AP lead calls the number from the file. The callback. Kemberwick's main line puts her through to the finance manager, who has not changed banks, did not send the email and has been wondering why the invoices are late. The registry. Kemberwick's state registration is active and unchanged, because the fraud never touched the company. It touched the correspondence. Put together, the request is an impersonation. The new domain, its age and an account abroad for a local supplier were each reason enough to call, and the call settled it. The manufacturer pays both invoices into the account on file, keeps the emails with their full headers, reports the lookalike domain to its registrar's abuse contact, files a complaint with the IC3 and tells Kemberwick, whose mailbox or a correspondent's needs checking. Who sent the email stays open, and the file says so. #### What to do if you have already paid The IC3's [guidance](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) begins: "If you discover a fraudulent transfer, time is of the essence." Call your bank at once on its official number, ask it to recall the payment and give it the full transaction details. Then report it. - In the US, [file a complaint with the IC3](https://www.ic3.gov/), which asks for one "regardless of the amount lost", with the full transaction details. Its Recovery Asset Team works with banks to freeze funds, and in 2025 it ran that process on 3,900 incidents involving $1.16 billion of attempted theft and froze $679 million, a 58 percent success rate. - In the UK, the NCSC [advises](https://www.ncsc.gov.uk/section/respond-recover/ml-business-payment-fraud) contacting your bank directly, using its official website or phone number. Report the fraud to [Report Fraud](https://www.reportfraud.police.uk/news/report-fraud-service-goes-live/), which replaced Action Fraud in December 2025 for England, Wales and Northern Ireland, or to Police Scotland on 101. UK Finance's figures show that £10.6 million of the £28 million lost to invoice and mandate scams on business accounts in 2025 was returned, a little under two-fifths. Keep the emails with their full headers, the bank letter, call notes and payment records. Tell the real vendor, whose mailbox may be the compromised one, and have your IT team check yours. #### What defeats these checks Each check has a known way around it. - A compromised vendor mailbox passes every domain check. The callback is what catches it, which is why it comes first. - A callback to a number the fraudster supplied reaches the fraudster. The number has to come from your own records. - A cloned voice can sound like a contact you know. The IC3 warns that "voice cloning can also be used to request wire payment", and businesses reported more than $30 million in losses in 2025 to business email compromise involving AI. A call you place to a number you hold is much harder to fake than a call you receive. - An insider can create a vendor and approve its invoices. The ACFE found that billing schemes ran a median 14 months before they were detected. Separating who sets up vendors from who approves payments is the control, and the registry and footprint checks show whether a vendor has any history outside your ledger. A registered company can still be a front, which our [shell company guide](https://www.sixtyfour.ai/blog/shell-company-red-flags) covers. #### Reading the evidence fairly Most of what makes a vendor request look odd has an ordinary explanation, and a fair review checks it first. - Vendors do change banks, after mergers or when they move to a new bank. The callback answers those requests too, and it is the same call whether the request is real or not. - New and small vendors are thin. A sole trader may have no website, no reviews and a free email address. Ask for different evidence: a call, a reference from another customer, a registration document. - An account-name check can return a close match or no match on a genuine account. The service's guidance is to enter a business's registered name or a trading name registered to the account, so an invoice that uses another trading name can produce a mismatch. A mismatch is a reason to call. - A second domain is not always a lookalike. Businesses buy domains for new brands and acquisitions, and the callback tells the two apart. - A vendor that checked out can change. Run the checks again when its details change, and every time its bank details do. #### Where Sixtyfour fits For a new supplier, the checks on the business take the longest by hand. Sixtyfour's agent starts from what you already have, such as a company name, a director or a website, researches public sources such as registry filings and the business's web footprint, links what it finds to the right company and people, and returns every finding with its source. Anything it could not establish is reported as open, and a person on your team decides. It does not check bank accounts or replace the callback. There is more on how financial crime teams use it on our [financial institutions page](https://www.sixtyfour.ai/solutions/financial-institutions). #### The short version Treat every change of vendor bank details as unverified until you have confirmed it on a phone number you already hold, with a second approver and an account-name check where your bank offers one. Before paying a new vendor, check its registry record, the people who sign its emails, its email domain and that domain's age, and the footprint other people have left. If money has already gone, call your bank to request a recall and report it straight away. --- ### How to tell if a LinkedIn profile is fake *A polished profile proves little. How to read a profile's age, badges, history and photo, look for the person outside LinkedIn, and weigh what each check is evidence of.* Source: https://www.sixtyfour.ai/blog/how-to-tell-if-a-linkedin-profile-is-fake Julian Wong · 2026-10-16 · Trust & Safety To tell if a LinkedIn profile is fake, check its history before its polish. Open the profile's About this member panel (LinkedIn's older name for it is About this profile) to see when it was created and what has been verified, read the work history for details that can be checked, run the photo through a reverse image search, and then look for the person outside LinkedIn, in records other people wrote about them over the years. A real career leaves those traces, and a fake profile usually has the career without them. No single check settles the question, so weigh them together. #### How common are fake LinkedIn profiles? LinkedIn, which says it has over 1.3 billion members, [reports](https://about.linkedin.com/transparency/community-report) that between July and December 2025 it stopped 88.9 million fake accounts at registration, restricted 24.4 million more before any member reported them, and restricted 361,300 after members did. LinkedIn says 99.7 percent of the fake accounts it stopped were stopped before a member report. The fakes that reach you are the ones those defences missed. They come in three kinds, and each needs slightly different checks. An invented person. NPR reported in March 2022 that Renée DiResta and Josh Goldstein of the Stanford Internet Observatory had found [more than 1,000 LinkedIn profiles](https://www.npr.org/2022/03/27/1088140809/fake-linkedin-profiles) using what appear to be AI-generated faces. More than 70 businesses were listed as employers. Several told NPR they had hired outside marketers to help with sales, but said they had not authorised computer-generated images. A real person, impersonated. The FBI [warned in 2024](https://www.ic3.gov/PSA/2024/PSA240903) that North Korean cyber actors impersonate people including "general recruiters on professional networking websites", using "pictures stolen from open social media profiles of the impersonated individual." A real person with an invented history. The name and face are genuine, and some of the jobs, titles or degrees are not. The checks in our guide to [verifying a resume](https://www.sixtyfour.ai/blog/how-to-verify-a-resume) apply here. #### When was the profile created? On the profile, click More and choose About this member. LinkedIn [introduced the panel in 2022](https://www.linkedin.com/blog/member/trust-and-safety/new-linkedin-profile-features-help-verify-identity-detect-remove-fake-accounts-boost-authenticity), as About this profile, to "show you when a profile was created and last updated", and it is also where verifications appear: LinkedIn's help pages say a workplace verification [may be visible](https://www.linkedin.com/help/linkedin/answer/a1453679) "in the About this member section". A creation date tells you how long the profile has existed, and nothing about the career it describes. A profile opened this year that claims fifteen years of work is not evidence of fraud, since people join late or delete an old account and start again, but it cannot vouch for its own history. A profile opened years ago, with activity spread across those years, carries some of its own evidence. Read any recent change the same way. An old profile that recently got a new photo, headline and location may belong to someone who changed jobs, or may be an account that changed hands. #### Can a fake profile have a verification badge? Yes, although a badge narrows what can be fake. Two of LinkedIn's [verifications](https://www.linkedin.com/help/linkedin/answer/a1359065) matter here, and both show as a badge beside the member's name to anyone logged in: - Identity verification means "a member's government-issued ID was verified by one of LinkedIn's verification partners", and the name used "must match the name on your LinkedIn profile." - Workplace verification means the member "has confirmed their association with the specific company", through a work email, Microsoft Entra Verified ID, or a LinkedIn Learning or LinkedIn Recruiter licence provided by the company. A work email [must match](https://www.linkedin.com/help/linkedin/answer/a1423367) "your current company's email domain." In September 2025, LinkedIn told reporters it would require workplace verification when a member adds or updates a recruiter title, or a senior title such as vice president, [Help Net Security reported](https://www.helpnetsecurity.com/2025/09/04/linkedin-expands-company-verification-workplace-checks/), quoting LinkedIn's vice president of trust product. Members who already held those titles were not asked to verify straight away, and LinkedIn's help pages say only that members "may need to complete workplace verification to add or edit your work experience." LinkedIn is also [testing a third kind](https://news.linkedin.com/2026/linkedin-launches-new-verification-features-to-build-professional-trust), announced in September 2026: it asks verified members to confirm the work or school experience of connections they worked or studied with, and "Once someone receives enough confirmations, LinkedIn adds a verification badge". Most profiles will not show it yet. The same announcement lets companies that have verified their LinkedIn Page remove impostors from search results under the company's name. So an identity badge shows that a verification partner checked a government ID and that LinkedIn matched it to the profile's name, or to an alias it could confirm, not that the jobs, schools or photo are real. A workplace badge shows that someone with access to the company's email, its sign-in or its LinkedIn licences confirmed the association. Neither shows who is using the account today. A fake can carry a badge when a real, verified person invents the rest of their history, or when someone else ends up controlling an account its original owner verified. A missing badge proves little. Verifications are optional, "identity verification is limited to select geographies", and the work email route is open only to some companies. The exception is a recruiter or executive title added since September 2025. A missing workplace badge there is worth a question, though not proof, since an unusual title may fall outside the rule. #### Does the work history have depth? Read the profile as a set of claims, the way you would read a resume. LinkedIn's own [guidance on fake profiles](https://www.linkedin.com/help/linkedin/answer/a1338436) points to profiles with little or no information, and to "Job titles that don't make sense, unrealistic career timelines or inconsistent dates." The profiles the Stanford researchers found had patterns in common. Many used titles like business development manager. They often listed two or three former employers, sometimes well-known names, with no details, and none of the companies NPR asked had records of the supposed employees. NPR contacted 28 universities about 57 of the profiles, and of the 21 that responded, none had records of the supposed graduates. Some profiles claimed undergraduate business degrees from schools that do not offer one. So check jobs against the employer, and a degree against the school, starting with whether the school offers that degree at all. Connections count for who they are. A profile [shows "500+"](https://www.linkedin.com/help/linkedin/answer/a549065) once a member has more than 500 connections, so the number says little. LinkedIn's [scam guidance](https://www.linkedin.com/help/linkedin/answer/a1336387) says to pay close attention to profiles that "are not connected to many employees within the company they represent." Mutual connections prove less than they seem, because many people accept invitations from strangers. Activity is the third layer. Posts and comments that other people replied to, spread over years, are hard to produce in a hurry. Endorsements take one click to give, so they count for little either way. #### How to tell if a LinkedIn profile picture is AI-generated By eye, usually you cannot. In a [2022 study in PNAS](https://www.pnas.org/doi/10.1073/pnas.2120481119), Sophie Nightingale and Hany Farid asked 315 people to sort AI-synthesised faces from real ones, and their average accuracy was 48.2 percent, close to chance. With training and feedback after each face, another 219 people reached 59.0 percent, and a third group rated the synthetic faces 7.7 percent more trustworthy than the real ones. Some synthetic faces, the authors suggested, "simply do not contain perceptually detectable artifacts." The tells that circulate come from older generators. DiResta's investigation began with a photo in which the woman wore only one earring, bits of her hair disappeared and reappeared, and her eyes sat right in the middle of the image. That last tell has a cause. A [2023 paper](https://farid.berkeley.edu/downloads/publications/cvpr23b.pdf) by LinkedIn researchers and Farid explains that faces from StyleGAN generators "are aligned in terms of ocular position and interocular distance", and are mostly generated from the neck up, while real profile photos tend to show more of the upper body and shoulders. Newer generators work differently. In the same 2023 paper, a detector trained on StyleGAN faces caught 0.9 percent of Stable Diffusion faces at a 1 percent false positive rate, because the diffusion process "does not rely on the same type of training from aligned faces." A [2024 LinkedIn model](https://www.linkedin.com/blog/engineering/trust-and-safety/finding-ai-generated-deepfake-faces-in-the-wild) trained on several generators caught 98 percent of AI faces from engines it had been trained on, falling to 84.5 percent for engines it had not seen, with its threshold set to wrongly flag 0.5 percent of real photos. A person looking at one photo has far less to go on, so treat a visual tell as a reason to keep checking, never as a finding. A reverse image search is more useful, because its results can be checked. Google's [search by image](https://support.google.com/websearch/answer/1325808) can return "Websites with the image or a similar image", and there are three outcomes: - The photo appears elsewhere under a different name, on pages older than the profile. This is strong evidence that the profile took someone else's photo, the method the FBI describes, and it breaks LinkedIn's [rules](https://www.linkedin.com/legal/professional-community-policies): "Do not use an image of someone else, or any other image that is not your likeness, for your profile photo." If the other pages are newer than the profile, the copying may run the other way, and a different name can still be the same person under a former or transliterated name, so check before concluding. - The photo appears elsewhere under the same name, on pages older than the profile. That supports the profile. - Nothing matches. That fits a generated face and a real person whose photo is not posted anywhere else equally well, so it settles nothing. #### Does the person exist outside LinkedIn? Of the checks you can run without contacting anyone, this one carries the most weight. When the Stanford researchers searched for the personas behind the profiles they had found, Goldstein told NPR, "we didn't find any evidence of them in other places, which is rare." Look for records that someone other than the person wrote, at the time: - The employer's own website: team pages, blog bylines, press releases, and archived copies of those pages from the years the profile claims. - Code. GitHub's API returns [public information about an account](https://docs.github.com/en/rest/users/users#get-a-user), including when it was created, and pull requests merged into real projects show work other people reviewed. - Talks, papers and patents, which carry their own dates and affiliations. - News, conference programmes, alumni announcements, and old forum or social accounts under the same name or handle. - If the person emailed you, the address itself. Our guide to [investigating an email address](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address) covers what one can show. Common names collide constantly, so a match needs two independent details to line up, such as a name and an employer at the same date. Our guide to [running an OSINT investigation](https://www.sixtyfour.ai/blog/how-to-run-an-osint-investigation) covers keeping those links honest. #### What a real footprint looks like over time A real professional's footprint builds up sideways. A colleague tags them in a team photo one year, a meetup lists them as a speaker another, and an employer's archived team page shows them one year and not the year before. Other people wrote most of it, across years and across services that have nothing to do with each other. A fabricated profile tends to be complete, recent and self-contained, written by its author inside a narrow window. A fake profile can copy a career. It cannot easily copy the years of other people mentioning it. Our guide to [spotting fake candidates](https://www.sixtyfour.ai/blog/how-to-spot-fake-candidates) calls this thinness. #### How the checks change with who is asking If you are hiring, the profile is one more claim from the candidate. Check that employers, titles and dates agree with the resume and any public work, and whether the profile existed before this job search. A thin profile is a reason to ask questions. If a recruiter has messaged you, find the company's careers page yourself and read how it says recruiters contact candidates, then check whether the recruiter shows a workplace badge and is connected to colleagues there. The warning signs in the FBI's 2024 alert include offers from prominent technology firms that are unexpected or involve "unrealistically high compensation without negotiation", "Requests to move professional conversations to other messaging platforms", and requests for a "pre-employment test" that means running unknown packages, scripts or GitHub repositories. LinkedIn's scam guidance adds, "Do not provide payment or account credentials as part of the application process." The FBI's advice is to verify a contact "using separate unconnected communication platforms." Recruitment approaches are also used for espionage. In November 2025, the UK's security minister [told Parliament](https://hansard.parliament.uk/commons/2025-11-18/debates/39086819-08E6-4218-A26E-6A3368FC5D9C/ChinaEspionageGovernmentSecurityResponse) that, according to MI5, Chinese intelligence officers were trying to cultivate people with access to sensitive information about Parliament and the government, "often masked through the use of cover companies or external headhunters", and that the National Protective Security Authority would strengthen its engagement with professional networking sites. Job fraud is common in its own right: the FBI's Internet Crime Complaint Center logged [24,688 complaints](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) of employment fraud in 2025, with reported losses of almost $363 million. If a stranger pitches you a product, the persona may be fronting a real company. NPR found that many of the AI-faced profiles seemed to exist to drum up sales, connecting anyone who replied to a real salesperson. Deal with the company through its own website. If you review reported accounts, you often meet LinkedIn profiles linked from a seller's storefront or a contractor's application. Compare the reported profiles with each other for the same few employers, the same headline formula, creation dates in the same weeks and the same style of photo. Our guide to [linking related accounts](https://www.sixtyfour.ai/blog/how-to-link-related-accounts) covers how much each shared detail is worth. Report the profiles to LinkedIn, and act on your own platform on your own evidence. #### A worked example The people, company and domain below are invented, and halvermoor.example uses a domain name reserved for documentation. An engineer at a fintech gets a LinkedIn message from Mara Ellingsworth, Senior Technical Recruiter at Halvermoor Payments, about a staff role at pay well above the market. After two messages, Mara suggests moving to Telegram, then sends a GitHub repository with a take-home exercise to run on the engineer's laptop. The engineer forwards it all to the security team. The profile. About this member shows it was created in June 2026, with no verifications. LinkedIn said in 2025 that it would ask for workplace verification when a recruiter title is added, so the missing badge is a question worth asking. Three earlier recruiting jobs at well-known companies have one line each. It shows 500+ connections, and the ones the team can see are mostly engineers at fintechs. Its only activity is a few reshared job posts from the past month. The photo. A clean headshot, eyes centred, cropped at the neck. A reverse image search finds no matches, which on its own settles nothing. The company. Halvermoor's careers page says its recruiters write only from halvermoor.example addresses and never ask candidates to install software. Its LinkedIn page lists four recruiters, each with a workplace badge, connected to each other and to dozens of colleagues, and posting Halvermoor's job ads for years. None of them shares a connection with Mara. Outside LinkedIn. The name returns nothing at all. The confirmation. The security team writes to the recruiting address on Halvermoor's careers page, and Halvermoor replies that it has no recruiter by that name. The requests match the FBI's warning signs, so nobody runs the repository. The team warns staff, and the engineer reports the profile to LinkedIn as not a real person. The decision rests on the company's answer and on what Mara asked for. Everything else only told the team where to look. Two questions stay open, and the team's notes say so: whether the photo was generated or taken from someone, and who is behind the account. #### What each check is evidence of | Check | What a strong result shows | What it cannot show | | --- | --- | --- | | Creation date | How long the profile has existed | That the career before it happened | | Identity badge | The profile's name was matched to a government ID a partner checked | That the jobs, schools or photo are real, or who uses the account now | | Workplace badge | The member confirmed an association with that company | The title, the dates or the role | | Connections at the stated employer | People there accepted the connection | That they know the person | | Image match under another name, on older pages | The photo very likely belongs to someone else | Who took it | | No image match | Nothing either way | That the face is generated | | Records others wrote, years old | The person existed and did that work then | That they run this profile today | | The employer, via its own channel | Whether the person works there | Whether this account is theirs | #### What defeats these checks An aged account. A profile opened years ahead and used lightly gets a creation date that looks earned, though the years are on the profile and not around it. A bought or taken-over account. A real account comes with real connections, real history and sometimes a badge its first owner earned. The signs are change: a new photo, headline, location or language on an old profile, often after a long silence. Impersonation of a real person. The photo, the name and often the employer are real, so the outside checks find a real person without proving that they run this profile. Contact the person or their employer through a channel you found yourself, and look for a duplicate of the person's real profile, which LinkedIn lists among its warning signs. A real, verified person with an invented history. The identity badge is genuine, so only the history checks catch it. A face from a newer generator, never posted anywhere, leaves the photo checks silent. These checks raise the cost of a convincing fake without making one impossible. The ones that hold up best go around the profile: the employer's own channel, and records other people wrote. #### Reading the signals fairly Most thin profiles belong to real people. New graduates have short histories, and plenty of professionals joined late, rarely post, or deleted an old account and started again. Verification is optional and not offered everywhere. Some people leave the photo off for privacy, work under a name that differs from the one on their documents, or have a name transliterated differently in different countries. Agency recruiters and contractors may not be connected to the staff of the companies they work with. And a real person may have used an AI tool to make a headshot of themselves, which is still their likeness. So keep three levels apart. Thin means look further. A contradiction, such as an employer or school with no record, a photo under someone else's name, or a company that denies the person, calls for an explanation. A confirmation through a channel you found yourself settles the question. If the profile belongs to a candidate or a customer, ask them about what does not fit before deciding anything. #### How to report a fake LinkedIn profile On desktop, open the profile, click More, then Report / Block, and select Report [name] or entire account. Select This person is impersonating someone or This account is not a real person, then submit the report. LinkedIn says reported members ["won't know who made the report."](https://www.linkedin.com/help/linkedin/answer/a1338436) If the profile is impersonating someone you know, tell them through a channel you already have. #### Where Sixtyfour fits Checking a profile by hand means working through company pages, archives, code, talks and news, and noting where every finding came from. Sixtyfour's agent starts from what you already have, such as a name, an email address or a known profile, researches public sources, and links what it finds to the same person. Every finding comes with its source, and anything it could not establish is reported as open rather than filled in. A person on your team decides what to ask and what to do next. There is more on how hiring teams use it on our [workforce identity page](https://www.sixtyfour.ai/solutions/workforce-identity), and on how platform teams use it on our [trust and safety page](https://www.sixtyfour.ai/solutions/trust-and-safety). #### The short version Check when the profile was created and what its verifications actually prove, read the work history for details that can be checked, and search the photo. Then look for the person outside LinkedIn, in records other people wrote over the years, and confirm anything that matters through a channel you found yourself. --- ### The new Sixtyfour search, tested on Exa's own benchmarks *Sixtyfour search now puts a match first on 90.4% of the queries in Exa's people search benchmark, ahead of every published result.* Source: https://www.sixtyfour.ai/blog/people-and-company-search-benchmark Yahia Salman · 2026-10-13 · Product We rebuilt how Sixtyfour search finds people and companies. On Exa's open people search benchmark, our first result now matches the search on 90.4% of queries. Exa publishes 72.0% for its own search. Figure: people-and-company-search-benchmark-overview.jpg | Bar charts of precision and R@1 on Exa's people and company search benchmarks. Sixtyfour leads every chart: people precision 82.8%, people R@1 90.4%, company precision 79.6% and company R@1 86.4%. | Sixtyfour against the results Exa publishes for Exa, Brave and Parallel, and the figure Juicebox reported. #### What changed You can describe the people or companies you want in plain English, the way you would brief a colleague. Several agents work on that request together, each writing part of the filters the search runs on. A reranking model then reads the results and judges how well each one fits what you asked for. The strongest fits move to the top of your list, and results that clearly don't fit are dropped. You spend less time skipping past people in the wrong role or the wrong city. This applies to natural-language people and company searches in the Sixtyfour app, the API and the MCP server. #### The results Exa released its [people search](https://exa.ai/blog/people-search-benchmark) and [company search](https://exa.ai/blog/company-search-benchmarks) benchmarks with the queries, the grading prompts and an evaluation harness in an [open source repository](https://github.com/exa-labs/benchmarks), so anyone can run them against their own search. The people benchmark has 1,400 queries like "director of marketing based in california senior level", and the company benchmark's retrieval track has 605. An LLM judge reads each result and decides whether it fits the query. Figure: people-and-company-search-benchmark-scores.jpg | Table of Sixtyfour against Exa on all six measures, with Sixtyfour's lead in points. People search: R@1 90.4% against 72.0%, R@10 96.6% against 94.5%, precision 82.8% against 63.3%. Company search: R@1 86.4% against 61.8%, R@10 94.4% against 94.2%, precision 79.6% against 65.9%. | Sixtyfour against the results Exa publishes for its own search, on every measure of both benchmarks. Sixtyfour reaches 82.8% precision on the people search benchmark, ahead of Juicebox (79%), Exa (63.3%), Brave (30.2%) and Parallel (26.9%).* Precision is the average share of returned results that are relevant. R@1 measures how often the top result is relevant, and R@10 how often at least one relevant result appears in the top ten. We graded with Exa's prompts unchanged, using GPT-5.4, the default in Exa's benchmark scripts until September 2026. You can try the new search in the Sixtyfour app or through the API, and the queries and grading are public if you want to check these numbers yourself. *Exa, Brave and Parallel: the results Exa publishes in its repository. Juicebox: its own reported figure. --- ### How to run an OSINT investigation *One case from the first question to the written report: how to scope it, pivot between identifiers, weigh each link, preserve the evidence and say how sure you are.* Source: https://www.sixtyfour.ai/blog/how-to-run-an-osint-investigation Saarth Shah · 2026-10-07 · Trust & Safety To run an OSINT investigation, start with a question you can answer and a written scope, list the identifiers you already hold, and pivot from each one while logging every search. Weigh each link by how rare the shared value is and whether it is independent of your other links, corroborate and date every finding, and save each source with its address, a timestamped capture and a hash. Stop when the question is answered, and write each finding with a stated likelihood and the evidence behind it. Keep the work passive throughout: read what is public, and never contact the subject. This guide follows one invented case from the first question to the write-up. Our guides to [email addresses](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address), [phone numbers](https://www.sixtyfour.ai/blog/how-to-investigate-a-phone-number), [related accounts](https://www.sixtyfour.ai/blog/how-to-link-related-accounts) and [website ownership](https://www.sixtyfour.ai/blog/how-to-find-out-who-owns-a-website) go deeper on the individual pivots. #### Start an OSINT investigation with a question you can answer A marketplace's trust and safety team receives nine non-delivery complaints in ten days about a new seller, Fenwray Optics, which lists camera lenses well below market price. Someone on the team thinks it looks like quillaperture, a lens seller banned in May for the same pattern. The two accounts share no phone number, email address, device or payout account on the platform, so the account records alone cannot answer it. "Find out everything about Fenwray Optics" has no end point, and it sends the analyst after every person the shop has touched. A workable question names what you want to know and the decision it serves. Here: is Fenwray Optics run by the same operator as quillaperture? If it is, the team treats the shop as ban evasion and holds its payouts. Write the scope down beside the question. The Berkeley Protocol on Digital Open Source Investigations, first published in 2020 by the UN human rights office and the Human Rights Center at UC Berkeley's law school, asks for an [online investigation plan](https://www.ohchr.org/sites/default/files/2024-01/OHCHR_BerkeleyProtocol.pdf) before the searching starts, setting out the objectives, priorities, strategy and a timeline. In this case the scope covers both shops' identifiers. The buyers who complained, the operator's family and anything that would need contact with the seller are out. The time box is one afternoon. Then list what you hold, and where each item came from: | Identifier | Source | First pivot | | --- | --- | --- | | Shop name and handle, fenwray_optics | Seller profile | The same strings elsewhere | | Email, fenwray.optics@example.com | Account record, verified at signup | Breach history and attached accounts | | Phone, +1 614 555 0172 | Account record and shop page | Ads, listings and directories | | Website, fenwrayoptics.example | Shop description | Registration date and archived copies | | quillaperture's handle, email and phone | The banned account | The same searches, for comparison | Note which items the platform verified. A verified email or phone number was in the operator's hands on the day of signup. A shop name or a founder's name on an About page is whatever the operator chose to type. #### Pivot from each identifier, and keep a log A pivot uses one identifier to find the next. Work through them one at a time and log every step as you go: the time, what you searched, where, what came back and what you did with it, dead ends included. The Berkeley Protocol describes an investigation as a cycle of inquiry, assessment, collection, preservation, verification and analysis that may be repeated many times as new information opens new lines of inquiry, and it asks investigators to document their activities in every phase. The log is what lets a colleague repeat your path, and it keeps the same search from being run three times. In the case, four pivots matter. - The website. Its registration record shows it was created in August 2026, and its earliest copy in a public web archive is from September. Its About page says the business has traded since 2009. - The email address. No breach history and no trace before September, which fits a new address. - The handle. fenwray_optics appears nowhere else. - The phone number. It appears in a classified ad from March 2024 for a used telephoto lens, which gives a contact address of quillaperture@example.net. That last pivot is the lead. The rest of the method is about how much weight it can bear. #### How strong is a link? Three questions decide it. How rare is the shared value? A link is worth more the fewer people could share it by chance. The string quillaperture has been used by one account on the platform, and the 2024 ad is the only other place it turns up. A shared city or a common first name would be worth almost nothing. Our guide to [linking related accounts](https://www.sixtyfour.ai/blog/how-to-link-related-accounts) sets out how to weigh a shared value by the number of accounts that have it. Is it independent of the other links? Two links that come from one fact count once. The shop page and the website list the same phone number because the operator typed it into both. That is a single link. Is it the same person, or only the same name? The website's About page names a founder, Theo Halvessy. A search finds a Theo Halvessy who works as a wedding photographer in another state, with a portfolio going back years. It is the same unusual name in a neighbouring field, and nothing else connects them: no shared phone number, email address, handle or image, and his own site lists a different number. Operators can put anyone's name on a page, including a real person's. He stays out of the case, and the team collects nothing more about him. Then try to break each link. Ask what would make it wrong. Here the answer is that the phone number could have passed to someone else between 2024 and 2026. Doing this on purpose matters. A [2026 study of confirmation bias in police investigations](https://journals.plos.org/plosone/article?id=10.1371%2Fjournal.pone.0327036) cites an earlier experiment in which participants told explicitly to try to falsify their first hypothesis showed less confirmation bias, while participants who only generated alternative hypotheses did not. #### Corroborate and date every finding A finding is corroborated when a second source supports it without having taken the fact from the first. Trace each fact to where it first appeared. The Berkeley Protocol calls this provenance, and suggests describing the earliest version you find as the "first copy found online", because the original may have been removed. Two articles quoting one press release are one source, and so are two profiles the operator filled in themselves. In the case, the second source comes from the platform's own listings. A quillaperture listing from April includes a photograph of a lens with its serial number visible on the barrel. A Fenwray listing from September shows the same serial number, in a different photograph against a different background. That link does not depend on the phone number at all. A resale could explain it, so it supports the conclusion rather than settling it alone. Then date every finding twice: when the thing happened, and when you saw it. Identifiers change hands and pages are edited, so an old record may describe someone else. The Berkeley Protocol notes that texts written at the time of the events they describe tend to be treated as more reliable than those produced long after. Dated, the case becomes a sequence: the ad in March 2024, quillaperture's listings from January to May 2026, the ban in May, the domain registered in August, the first Fenwray listing in September. The phone number appears under no other name anywhere in that period. That does not prove it never changed hands, and the report will say so. #### Preserve your sources so others can check the work Pages disappear. A [Pew Research Center analysis](https://www.pewresearch.org/data-labs/2024/05/17/when-online-content-disappears/) found that a quarter of the webpages that existed at some point between 2013 and 2023 were no longer accessible by October 2023, and that 38 percent of pages from 2013 were gone. An old classified ad is exactly the kind of page that expires. For each page a finding rests on, keep: - its URL; - a full-page capture that shows the date and time; - the page's HTML source; - a hash of every saved file, using an algorithm from the [Secure Hash Standard](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf) such as SHA-256, so anyone can later confirm the file has not changed; - a log entry saying who captured it and when. That list follows the collection guidance in the Berkeley Protocol. A screenshot on its own is weak evidence. As a [guide to archiving](https://www.bellingcat.com/resources/how-tos/2018/02/22/archive-open-source-materials/) from the investigative newsroom Bellingcat puts it, "Screenshots can be easily forged." A public archive copy helps. The Internet Archive's [Save Page Now](https://help.archive.org/help/save-pages-in-the-wayback-machine/) gives a permanent URL for a single page. Public copies are open to anyone with the address, though, so keep your own copy as well. #### When to stop Stop when the question has an answer at the confidence the decision needs. The leads will not run out on their own. Three signs tell you that you are there: the next pivots return what you already have, the next pivot leads outside the scope, or the time box is spent. In the case, the team has two independent links and a dated sequence. The remaining leads point at the photographer and at the operator's real-world identity. Neither is needed to answer the question, and following them would mostly mean collecting information about people outside it. The Berkeley Protocol's principle of data minimisation says online content should only be collected if it is relevant to a particular investigation. So the team stops, and records what it did not establish as open. #### Write the findings with stated confidence Readers take the same words to mean very different odds. In a [1964 essay](https://www.cia.gov/resources/csi/static/Words-of-Estimative-Probability.pdf) published by the CIA, Sherman Kent recalled a 1951 intelligence estimate that called an attack on Yugoslavia that year a "serious possibility". Kent meant odds of about 65 to 35 in favour of an attack. The State Department officials reading it had taken it to mean much lower odds, and when Kent asked the colleagues who had agreed the wording, their answers ran from about 20 to 80 up to 80 to 20. A fixed scale is meant to close that gap. The US intelligence community's analytic standards, [ICD 203](https://archive.dni.gov/files/documents/ICD/ICD-203.pdf), tie each likelihood word to a range, so that "likely" means 55 to 80 percent and "very likely" means 80 to 95 percent. They also ask analysts to keep the likelihood of a judgement separate from their confidence in its basis, to separate the underlying information from assumptions and judgements, and to name what would change the judgement. They were written for intelligence analysts, and the habits suit any team writing for someone who has to decide. The case's findings, written that way: - Fenwray Optics is very likely (80 to 95 percent) run by the same operator as quillaperture. This rests on two independent links: the shop's phone number appears in a March 2024 ad that uses quillaperture's handle, and listings from both shops show a lens with the same serial number. Our confidence is moderate, because the phone link assumes the number did not change hands between 2024 and 2026. A record of another holder in that period would lower the likelihood. - The website's claim to have traded since 2009 is not supported by any record found. The website was registered in August 2026, and its earliest archived copy is from September 2026. - Open: who the operator is. The About page names a founder, and the one person found with that name has no connection to either shop in any record reviewed. Every sentence points to a logged and preserved source, so a reviewer can check each one before the team acts. #### Working passively and fairly Open-source research reads what is already public. The Berkeley Protocol draws the line at contact: information acquired from internet users by communicating with them counts as closed source. In practice that means no messages to the seller, no follow requests, no password reset forms and no test logins. Contact also tells the operator someone is looking, which can lead them to delete the accounts you were about to find. Do not deceive people to get information. The Protocol warns that misrepresentation can damage an investigation's credibility and contaminate the information collected. Watch your own footprint. Some platforms tell people who looked at them: depending on the viewer's privacy settings, [LinkedIn shows](https://www.linkedin.com/help/linkedin/answer/a568195) a profile's owner the viewer's name, headline, location and industry. Check those settings before you start. Collect as little about other people as the question allows. Every investigation passes bystanders: the photographer who shares a name, the buyers, the previous holder of a phone number. The Berkeley Protocol lists bystanders among the people an investigation may need to protect. Leave them out of the record unless the question needs them. #### Reading the results fairly A finding is only as good as the record behind it, and the record is uneven. Quiet is normal. New identifiers, careful people and people who rarely post all leave thin trails. When a search comes back empty, try another identifier before reading anything into the silence. Identifiers change hands. Phone numbers are recycled, domains lapse and are registered again, and accounts are sold. Dates are what separate one holder from the next. Names are claims. Anyone can put a name on a page, so a name match needs an identifier match behind it. Some people are harder to find than others. The Berkeley Protocol notes that online information may be unevenly available from certain groups or segments of society, so a thin result may describe the record more than the person. And "very likely" leaves a real chance of being wrong. That is why a person reviews the evidence before anyone acts on it. #### Where Sixtyfour fits Much of this method is collection: running each identifier across many sources, following it to the next one, and keeping a source for every fact. Sixtyfour's agent does that part. It starts from an identifier, such as an email address, phone number, username, name or company, researches public sources, links the findings that belong to the same person or company, and returns every finding with its source. Anything it could not establish is reported as open. The results go to your team, and a person decides what happens next. There is more on how investigation teams use it on our [investigations page](https://www.sixtyfour.ai/solutions/investigations). #### The short version Write down a question you can answer and its scope, list the identifiers you hold, and pivot from each one with a log. Count a link only when the shared value is rare and independent of your other links, try to break it, then corroborate and date every finding and preserve each source with a capture and a hash. Stop when the question is answered, and write each finding with a stated likelihood, the evidence behind it, and what is still open. --- ### How to find out who owns a website *Most registration records now hide the owner. The pivots that still work, what each one is evidence of, and how to tell today's operator from a domain's earlier owners.* Source: https://www.sixtyfour.ai/blog/how-to-find-out-who-owns-a-website Hashim Khawaja · 2026-10-06 · Trust & Safety To find out who owns a website, look up its registration record through RDAP, which replaced WHOIS as the source of registration data for generic domains in January 2025. Then follow the pivots that survive redaction: the site's DNS and hosting, the certificates issued for it, its archived history, the identifiers on its pages and the business it claims to be. The registrant's name is usually hidden, so ownership has to be pieced together from several of these, each with a date attached, and the person running the site today may not be the one behind its oldest traces. #### What you can find out about who owns a website A website has several owners. The registrant holds the domain, bought from a registrar. A hosting company runs the servers. And an operator, who may be none of these, decides what the pages say and where the money goes. In a scam storefront or a phishing site you want the operator, and you can contact the registrar and the host. Few pivots name the operator directly. They show which other sites the same operator runs, and an operator careful on one site may be careless on another. In a [2018 study of analytics IDs on malicious websites](https://www.securitee.org/files/malanalytics_www2018.pdf), researchers identified 59 operators of malicious sites by finding public registration records for other domains that shared the same analytics IDs. Domains also lapse and change hands. So, as with a [phone number](https://www.sixtyfour.ai/blog/how-to-investigate-a-phone-number), every finding needs a date, and every link to a person needs a second source. #### Question one: what does the registration record say? Since 28 January 2025, ICANN has treated RDAP, the Registration Data Access Protocol, as [the definitive source](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en) of registration data for generic top-level domains such as .com, in place of WHOIS. ICANN's [Lookup tool](https://lookup.icann.org/en) queries it. Under ICANN's [Registration Data Policy](https://www.icann.org/en/contracted-parties/consensus-policies/registration-data-policy), every generic-domain record publishes the creation and expiry dates, the registrar and its abuse email address and phone number, the status codes and the name servers. It may also show the [last transfer](https://itp.cdn.icann.org/en/files/registry-operators/rdap-response-profile-21feb24-en.pdf), meaning a change of registrar, not necessarily of owner. Of the [status codes](https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en), clientTransferProhibited is a lock that helps prevent hijacking, clientHold and serverHold mean the domain will not resolve, and redemptionPeriod and pendingDelete mean it is being deleted. The registrant is another matter. In May 2018 ICANN adopted a [temporary specification](https://www.icann.org/resources/pages/gtld-registration-data-specs-en) that restricted most personal data to "layered/tiered access", and registrars began replacing registrants' details with text such as "REDACTED FOR PRIVACY". Where redaction applies, the policy that replaced it on 21 August 2025 withholds the registrant's name, street, postal code and phone numbers, optionally the city, and swaps the email address for a relay address or a web form. It still publishes the registrant's country, the state or province where one was collected, and the organisation name if the registrant agreed. A privacy or proxy service shows its own details instead of its customer's. Country-code domains such as .uk follow [rules set within each country](https://www.icann.org/resources/pages/cctld-2012-02-25-en), so use that registry's own service. To ask for the redacted data on a generic domain, use ICANN's free [Registration Data Request Service](https://www.icann.org/rdrs-en), which needs an ICANN account and is meant for requesters such as consumer protection advocates and cybersecurity specialists. Registrars take part voluntarily, country-code domains are not covered, and [the registrar decides](https://www.icann.org/rdrs-requestors-faqs-en.pdf) whether to disclose anything. ICANN says the service [does not guarantee access](https://www.icann.org/resources/press-material/release-2023-11-28-en). Otherwise, use the registrar's own disclosure process. Expect delay or refusal, and keep working the other pivots. #### Question two: how old is the site, and has it changed hands? A registration date marks the start of the current registration, which is not always the start of the site's history. When a lapsed domain is deleted, the registry holds it for 30 days, and five days after that, [ICANN's guide](https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en) says, it is purged and "becomes available for registration". The next registrant gets a new creation date, and the authors of a [2017 study of re-registration](https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-lauinger.pdf) detected re-registrations exactly that way. Every day, they wrote, hundreds of thousands of domains are abandoned, and about 10 percent of deleted .com domains were registered again the same day. The new holder inherits the domain's reputation, which [researchers call residual trust](https://astrolavos.gatech.edu/articles/domain-z-ieee.pdf), and adversaries do exploit it. A domain that is sold keeps its original creation date instead, and the 2017 study found that expired domains sold before deletion show "only very limited cues as to the new ownership". So read the creation date against the site's history. A recent date on a domain with years of history means it lapsed and was registered again. An old date with an abrupt change in what the site does may mean a sale. Two public records supply that history. The Internet Archive's Wayback Machine shows the site on each date it was captured, including old contact and about pages. Its help centre explains how to [list everything archived for a domain](https://help.archive.org/help/using-the-wayback-machine/). Gaps prove little, because the Archive misses sites its crawlers did not know about, sites that blocked them, and sites whose owners asked to be excluded. Certificate transparency logs, first specified in [RFC 6962](https://www.rfc-editor.org/rfc/rfc6962), are public and append-only, and [anyone can query them](https://certificate.transparency.dev/howctworks/) "to see what certificates have been included and when". In versions of Chrome that [enforce certificate transparency](https://googlechrome.github.io/CertificateTransparency/ct_policy.html), a publicly trusted certificate that has not been logged fails to validate, so an ordinary HTTPS site leaves a trail. A free search such as [crt.sh](https://crt.sh/) lists each certificate's dates and names, which often reveals subdomains and shows when the site took its current form. A certificate can date a site without naming its owner: Let's Encrypt [offers only domain-validated certificates](https://letsencrypt.org/docs/faq/), which under the [CA/Browser Forum's rules](https://cabforum.org/2015/09/28/ballot-151-addition-of-optional-oids-for-indicating-level-of-validation/) carry no organisation name. #### Question three: where is it hosted? DNS records show the infrastructure behind the name ([RFC 1035](https://www.rfc-editor.org/rfc/rfc1035), [RFC 3596](https://www.rfc-editor.org/rfc/rfc3596)). A and AAAA records give the server's addresses, NS records the name servers, MX records the mail servers and TXT records free text. That text often includes an SPF record ([RFC 7208](https://www.rfc-editor.org/rfc/rfc7208)) authorising the hosts that may send the domain's mail, which can name the operator's mail services. An RDAP lookup on the server's IP address returns the network's registration and its abuse contact, which, as the RIPE NCC [warns](https://www.ripe.net/about-us/support/abuse/), "will be an ISP or other network operator - not the abuser". That is where takedown reports go. A shared IP address is weak evidence. A [study published in 2020](https://arxiv.org/abs/2004.04623) found more than 60 percent of websites co-located with at least ten others. Count the domains on an address before reading anything into it, as in [linking related accounts](https://www.sixtyfour.ai/blog/how-to-link-related-accounts): a handful can be a lead, two thousand is background. Behind a security proxy or content delivery network, as one [measurement study](https://www.securitee.org/files/cloudpiercer_ccs2015.pdf) put it, "the origin's IP address is no longer listed in the DNS records of the domain name", so the address you see is the provider's. Parked domains use a parking service's name servers, and a [2015 study](https://www.securitee.org/files/parking-sensors_ndss2015.pdf) counted more than 8 million of them, so shared parking says nothing about ownership. #### Question four: what links it to other sites? Certificates. One certificate can cover several names, as [Let's Encrypt's FAQ](https://letsencrypt.org/docs/faq/) notes. Two unrelated-looking domains on one certificate were requested together, either by one owner or by a hosting provider that puts [domain names from numerous distinct customers](https://arxiv.org/abs/1906.10775) on a shared certificate. Analytics IDs. The 2018 study found that shared analytics IDs cluster sites "managed by the same person/team", even on different servers and behind registration privacy, and that such sharing is "very common across both benign and malicious website owners". In an old Universal Analytics ID such as UA-123456789-1, [the centre number identifies the account](https://www.bellingcat.com/resources/2024/01/09/using-the-wayback-machine-and-google-analytics-to-uncover-disinformation-networks/). Google [stopped processing](https://support.google.com/analytics/answer/11583528?hl=en) standard Universal Analytics data in July 2023, and Bellingcat calls the replacement IDs "less uniform", but old ones survive in archived copies of a site. Two cautions from the same study: a phishing page cloned from a real site often carries the victim's ID, because the cloning software copies the analytics code, and hosting companies' pages for suspended accounts can share one ID across many domains. Verification tokens. Services ask site owners to publish a token, in a TXT record or a meta tag, to prove control. Google describes its Search Console tag as "[tied to a specific user](https://support.google.com/webmasters/answer/9008080?hl=en)", and its verification API issues [a different token for each site](https://developers.google.com/site-verification/v1/getting_started). An [IETF draft on domain verification](https://datatracker.ietf.org/doc/draft-ietf-dnsop-domain-verification-techniques/) describes tokens that identify either the challenge or the user. The same token on two domains points to one account or to a record copied between them, and either is a link. A cloned page carries its meta tags with it, while a TXT record stays behind. Contact and payment details. Phone numbers, email addresses, messaging handles and the account buyers pay into. Our guides to an [email address](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address) and a phone number cover what each can prove. Payment details from victims' reports are among the strongest links, because the money has to reach someone. | Shared value | What a match suggests | How it misleads | Starting weight | | --- | --- | --- | --- | | Receiving bank account or wallet | One operation collects the money | The named holder may not be the operator | Strong | | Analytics account | One person or team manages both sites | Cloned pages, and agencies with many clients | Strong once cloning is ruled out | | Verification token | One account, or a copied record | Cloned meta tags | Medium to strong | | Contact phone or email | One operator answers both sites | Copied templates, recycled numbers | Medium to strong | | Certificate | Names requested together | Shared hosting certificates | Medium | | Name servers or IP address | The same provider or server | Shared hosting, content delivery networks, parking | Weak unless few sites share it | Count only independent links: an analytics account and a token set up in one sitting are nearly one observation. #### Question five: who does the site claim to be? Check any company, address or registration number named in the footer, terms, contact or imprint pages against the registry of the country named. In the UK, Companies House gives [free details](https://www.gov.uk/get-information-about-a-company) of any company, including its registered address, date of incorporation, current and resigned officers and previous names. Look for an incorporation date years after the site's claimed founding, or a registration number that belongs to a differently named company. That company's details were probably borrowed, and it belongs in the report as an affected party. #### A worked example The case below is a composite. Its domains use the [.example names](https://www.rfc-editor.org/rfc/rfc2606) reserved for documentation, its IP address comes from a [range reserved for examples](https://www.rfc-editor.org/rfc/rfc5737), and its phone number from the 555-0100 to 555-0199 range reserved for fiction. In late September 2026, a marketplace's trust and safety team receives reports from four buyers. Each saw a well-known outdoor brand's jackets at half price from one of three seller accounts opened that month, was told to order "direct from our outlet" at brindlecote.example, paid by bank transfer and received nothing. The registration. RDAP shows a registration on 11 September 2026 through a large retail registrar, with a privacy service in place of the registrant. The site's about page says it has served customers since 2011. The history. The Wayback Machine shows a small homewares shop on the domain from 2012 to 2021, then a for-sale parking page, then the storefront from mid-September 2026. The certificate logs agree: yearly certificates for the shop until 2021, then a new one on 12 September 2026, covering a checkout subdomain too. The domain lapsed and was registered again, so "since 2011" borrows the shop's history, and the domain's earlier holders are filed as previous registrants and nothing more. The hosting. The site resolves to 203.0.113.42, shared with about 1,900 other domains, so the address is set aside. The fingerprints. The page carries two analytics tags. One is the brand's own, copied when the storefront was cloned, so it links the scam only to its victim. The other appears on one other site, jacket-clearance.example, a storefront copying a different brand, registered in August 2026. The two domains publish the same verification token in their TXT records, and both contact pages give the same WhatsApp number, +1 312 555 0164. The money. Two buyers had already reported jacket-clearance.example to the marketplace, and the bank details they were given match the brindlecote.example buyers'. The business. Companies House shows that the UK company number in the footer belongs to an unrelated dormant company, which is filed as an affected party. Put together, the storefronts are one operation. The analytics account and the token may come from one set-up session, so they count as one strand, and the contact number and the bank account are independent of it and of each other. The team acts on the three seller accounts, archives the storefronts, reports both domains to their registrars' and hosts' abuse contacts and to Google Safe Browsing, and files a disclosure request with the registrar. Who the operator is stays open: the registrant is behind a privacy service, the request may go unanswered, and the account holder's identity sits with the bank. The report says so. #### Investigating without alerting the operator Most pivots above are read from third parties. Visiting the site is different, because its server can log every request. When you need to see it, use an isolated browser, and do not log in, fill in forms, start a checkout or enter any details. Take payment details from victims' reports, never from a test order. Preserve evidence with screenshots and the Archive's Save Page Now, which saves [one page at a time](https://help.archive.org/help/using-the-wayback-machine/). Report through abuse contacts and [Safe Browsing](https://developers.google.com/search/help/report-quality-issues), never to the operator. #### Reading the results fairly Most of what makes a website look suspicious has an ordinary explanation, and a fair report checks for it first. A hidden registrant is normal. Registrars have redacted personal data since 2018, and before that an ICANN-commissioned study found privacy or proxy services on about [20 percent of domains](https://www.icann.org/en/blogs/details/results-of-the-gnso-whois-privacyproxy-abuse-study-17-9-2013-en) in the top five generic top-level domains. A [later study for ICANN](https://www.cl.cam.ac.uk/~rnc1/whoisstudy.pdf) found them more often on domains used for harm, but also on 28 percent of the legitimate banks it examined. A young domain is normal for a new business, and a domain with someone else's history may have been bought in good faith. Shared hosting, content delivery networks and parking services put strangers on one address. Previous owners in archives and old certificates are earlier holders and nothing more. A cloned page's analytics ID and meta tags point to the brand it copied. Agencies and freelance developers build many clients' sites, so a shared analytics account can mean a shared developer. And a company named on a site may never have heard of it. #### Where Sixtyfour fits Run carefully, the five questions take time, and much of what they produce is a set of identifiers: email addresses, phone numbers, usernames and company names. Sixtyfour's agent starts from identifiers like these, researches where each one appears across public sources, links what it finds to one person or entity, and returns every finding with its source. Anything it could not establish is reported as open, and a person on your team decides what happens next. There is more on how trust and safety teams use it on our [trust and safety page](https://www.sixtyfour.ai/solutions/trust-and-safety). #### The short version Read the registration record, date the site through its archive and certificates, find where it is hosted, and search for the accounts, tokens, contact details and payment details it shares with other sites. Give every finding a date and a weight, count only independent links, and mark what you could not establish as open. --- ### How to verify a resume: employment history, degrees and licences *Job seekers stretch claims more often than they invent them. How to check each claim against a record the candidate did not write, and what a mismatch can mean.* Source: https://www.sixtyfour.ai/blog/how-to-verify-a-resume Julian Wong · 2026-10-06 · Trust & Safety To verify a resume, treat it as a list of separate claims and check each one against a record the candidate did not write: the registrar for a degree, the issuing board's register for a licence, company registries and archived copies of the employer's own website for a job, and the project's own history for open-source work. Confirm anything that is not public, such as employment dates or a transcript, with the employer or school directly and with the candidate's consent. Then mark each claim as confirmed, explained or open, and ask the candidate about anything that does not line up. This guide assumes the person is real and asks whether their claims hold up. Whether the person behind an application is who they say they are is a separate question, covered in our guide to [spotting fake candidates before the interview](https://www.sixtyfour.ai/blog/how-to-spot-fake-candidates). #### How to verify a resume, one claim at a time Job seekers stretch claims more often than they invent them. Christine Henle, Brian Dineen and Michelle Duffy ran three anonymous surveys, two of US business students and one of working adults who had recently found a job. On average, 72 percent said they had embellished their resume in their current or most recent job search to at least some extent, 61 percent had left relevant information out, and 31 percent had fabricated information ([Journal of Business and Psychology, 2019](https://doi.org/10.1007/s10869-017-9527-4)). The authors define fabrication as intentionally falsifying information, such as listing a degree never earned, and embellishment as exaggerating otherwise accurate information, such as overstating involvement in a project. The same paper notes that checking only one kind of claim, such as degrees, leaves the rest undetected, and that some claims, such as how involved someone was in a project, may be hard to confirm. So start by writing the resume out as claims. "Senior engineer, Quillmere Data, 2019 to 2022" is three of them: an employer, a title and a pair of dates. Each can hold up while another does not. | Claim | Who can confirm it | Public trace to look for | | --- | --- | --- | | Employer and dates | The employer, with the candidate's consent | Company registry, archived team pages, bylines and conference bios | | Job title | The employer | Archived team pages, talk and paper bios | | Degree | The school's registrar | The school's accreditation, though not the degree itself | | Professional licence | The board that issued it | The board's public lookup | | Certification | The issuer, from a credential ID or badge link | Often nothing you can search by name | | Open-source work | The project | Reviewed pull requests, the maintainers list | | Talks, papers, patents | The organiser, publisher or patent office | The programme, the paper, the patent record | | Scope ("led", "owned", "grew") | Colleagues and references | Rarely anything | Put most of the effort where fabrication is possible: employers, titles, dates, degrees and licences. Scope claims matter too, but interviews and references test them better than records do. #### Which claims leave a public footprint Weigh every record by who wrote it and when. A conference programme from 2021 that lists someone with their employer was written by the organisers at the time. A blog post the candidate published in 2019 was written by them, but before this application existed. A profile updated last month was written by the candidate for this job search, and counts for least. The size of the employer changes what you can find. A role at a company of thousands rarely shows on the company's own website, so any trace is the person's own: a talk, the affiliation line on a paper, a profile kept for years. A 30-person startup is often the opposite. Its team page may have listed everyone, it may since have closed or been acquired, and archived copies of its site may be the best record left. Open-source work can leave a detailed trace, and it needs careful reading. GitHub [places a commit on a profile](https://docs.github.com/en/account-and-profile/reference/profile-contributions-reference) by its author date, and Git lets whoever makes a commit [override that date](https://git-scm.com/docs/git-commit). A profile's graph can also include private contributions, shown as daily counts with no detail. So treat the graph as a summary. The stronger evidence is inside the project: pull requests that other maintainers reviewed and merged, and the commit that added the person to the maintainers list. Talks, papers and patents carry their own dates and affiliations. Check the conference's own programme and the paper itself. US patents can be searched by inventor in the [USPTO's Patent Public Search](https://www.uspto.gov/patents/search/patent-public-search), which from 7 November 2026 can only be used while signed in to a USPTO account. #### How to verify degrees, licences and certifications Start by checking that the school is real and accredited. The US Department of Education's [Database of Accredited Postsecondary Institutions and Programs](https://ope.ed.gov/dapip/) (DAPIP) holds information reported by recognised accrediting agencies and state approval agencies. The Department notes that this information is not audited, and that institutions outside the United States are not included. The Council for Higher Education Accreditation (CHEA) keeps its own [database of accredited institutions and programmes](https://www.chea.org/directories), plus an international directory of more than 500 quality assurance bodies, accreditation bodies and ministries of education around the world, which is where to start with a degree from abroad. Accreditation can be faked too. The FTC warns that some fake degree programmes [make up an accreditor or lie about being accredited](https://consumer.ftc.gov/articles/college-degree-scams) by a real one, and that some diploma mills use names very close to those of well-known universities. Then confirm the degree with the school. The FTC's guide for employers says most registrars will [confirm dates of attendance and graduation](https://www.ftc.gov/business-guidance/resources/avoid-fake-degree-burns-researching-academic-credentials), degrees awarded and majors, and that with the applicant's permission they may provide a certified transcript. Find the registrar through the school's own website, because the same guide notes that some diploma mills offer a "verification service" that sends a fake transcript to employers who call. US colleges can hand degree verification to the [National Student Clearinghouse](https://www.studentclearinghouse.org/about/), a nonprofit founded by the higher education community, which answers from the records schools send it and [puts its coverage](https://www.studentclearinghouse.org/solutions/ed-verifications/) at 96 percent of US four-year degrees. Licences are issued by boards, and boards often publish a lookup. California's engineering board, for example, [points anyone checking a licence](https://bpelsg.ca.gov/about_us/contact.shtml) to the lookup on its website. CPAs can be checked in [CPAverify](https://nasba.org/blog/2026/03/12/all-about-cpaverify/), a free search hosted by the National Association of State Boards of Accountancy with data sent by the state boards (53 jurisdictions took part as of March 2026). Check the name, the status, and that the licence covers the state and discipline the resume claims. Certifications often cannot be looked up by name. AWS, for example, [does not provide a list](https://aws.amazon.com/certification/faqs/) of certified people, and asks anyone verifying a certification to request the holder's digital badge link. Ask for the credential ID or link, and check it through the verification route the issuer gives. #### How to verify employment history Work through five questions, in this order. Did the employer exist at the time? Company registries date it. Delaware's free entity search gives an [incorporation or formation date](https://icis.corp.delaware.gov/ecorp/entitysearch/NameSearch.aspx), and the UK's Companies House shows the [date of incorporation and previous company names](https://www.gov.uk/get-information-about-a-company) free of charge. A company incorporated after the claimed start date needs an explanation, and there may be an ordinary one, such as a founding team that worked together before it incorporated. Was the person there? The employer's own website from the time is the best public witness, and the Internet Archive keeps old copies. Its help centre explains how to [list everything archived from a site](https://help.archive.org/help/using-the-wayback-machine/), which turns up old team, about and blog pages. The archive is incomplete and says so: some sites are missing because its crawlers did not know they existed. Its Save Page Now feature also lets anyone save a page, so a capture of a page the candidate controls shows that the page existed on that date, and nothing more. Who else recorded it? Conference programmes, papers with affiliation lines, press releases and engineering blog posts with bylines all name people and employers at a date, and someone other than the candidate wrote them. What did the candidate say at the time? A profile kept for years, especially one archived along the way, shows what they said about a job while they held it. Our guide to [investigating an email address](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address) covers finding the accounts behind one identifier. What does the employer say? Dates and title come from the employer, through contact details you find yourself, once the candidate has agreed to the check. #### A worked example The candidate, companies and project in this example are invented. Tamsin Arlecourt applies for a remote senior backend role. Her resume claims: 1. Staff engineer at a large payments company, September 2022 to now, where she "led the migration of the settlement ledger to a new database". 2. Senior engineer at Quillmere Data, a 30-person analytics startup, January 2019 to August 2022. 3. A master's in computer science, completed online in 2018 at a US state university. 4. Maintainer of an open-source database migration library since 2021. 5. A talk at a regional engineering conference in 2021. The degree. The university is listed in DAPIP with a recognised accreditor, and with Tamsin's consent the registrar confirms the master's and its 2018 date. Confirmed. The open-source work. Her merged pull requests in the project start in 2020, reviewed by two other maintainers, and a 2021 commit by the project's founder adds her to the maintainers file. Her contribution graph goes back to 2014, which on its own would not have counted. Confirmed. The talk. The conference's 2021 programme, still on its website, lists "Tamsin Arlecourt, Quillmere Data", and the recording is on the conference's channel. Confirmed, and it also places her at Quillmere in 2021. Quillmere. Its website, quillmere.example, now redirects to the company that acquired it in 2022. The Delaware registry shows it incorporated in 2016, before her claimed start. Archived captures of its team page list her from October 2019 onwards, and captures from early 2019 do not. The acquirer's HR team, contacted with her consent, confirms her as a senior engineer from July 2019 to August 2022. The resume's start date is six months earlier than the employer's record, so that goes to the candidate as a question. The payments company. With her consent, it confirms her dates and title. Nothing public mentions the ledger migration, which is not unusual for internal work at a large company. Asked about the start date, Tamsin explains that from January to June 2019 she worked on Quillmere's team as a contractor, placed there by a contracting firm, and was hired in July. She names the firm, which confirms the placement. The US Bureau of Labor Statistics counts this arrangement as workers provided by contract firms: people who [work for a contract company, are usually assigned to only one customer](https://www.bls.gov/news.release/conemp.tn.htm), and usually work at that customer's worksite. Her resume folded the contract into the job. | Claim | Evidence | Status | | --- | --- | --- | | Master's, 2018 | Accreditation listing, registrar | Confirmed | | Open-source maintainer since 2021 | Reviewed pull requests, the commit adding her as a maintainer | Confirmed | | 2021 talk | The conference's own programme and recording | Confirmed | | Quillmere, January 2019 to August 2022 | Registry, archived team page, the acquirer's HR, the contracting firm | Explained: contractor January to June, employee from July | | Payments company, dates and title | Employer confirmation | Confirmed | | Led the ledger migration | Nothing public | Open | The open claim becomes an interview topic: what the migration involved, which decisions were hers, and who else worked on it. With her agreement, a reference from that team can speak to it. #### What a mismatch can mean Many mismatches have an ordinary cause. Henle and colleagues leave unintentional errors, such as forgetting the dates of jobs held long ago, out of their definition of resume fraud, and note that misrepresentations can come from honest mistakes, poor advice from placement services or forgotten information. | Mismatch | Common innocent cause | What to ask for | | --- | --- | --- | | Start date earlier than the employer's record | A contract period through an agency, or dates rounded to the year | The agency's name, a contract or an offer letter | | Company not found under that name | Renamed, acquired, or trading under a name other than its registered one | The former name or the acquirer | | Title differs from the employer's record | Internal titles often differ from the ones used on resumes | The internal title and level | | No degree record found | A name change since graduation | The name used at the school | | Overlapping roles | Part-time work, consulting, a notice period | Which role was full-time | | A gap | Study, caring, illness, a long search | What they were doing, if they choose to say | Fabrication tends to look different, and it survives the candidate's explanation: an employer with no trace in any registry, archive or third-party record, a school whose only accreditor is not recognised, a licence missing from the board that supposedly issued it, or a record that contradicts the resume outright. #### How to ask the candidate about gaps and discrepancies Ask about one thing at a time, and say what you found. "Our record shows you starting at Quillmere in July 2019, and your resume says January. Can you tell us about those months?" gives the candidate room to explain, and the explanation usually comes with something you can check. For anything beyond public information, such as contacting a former employer, asking a registrar to confirm a degree or requesting a transcript, tell the candidate what you plan to check and get their consent first. It is courteous, and candidates can often point you to a faster route, such as the agency that paid them or the name they studied under. #### Reading the results fairly This method finds what was recorded, and plenty of real careers leave little record. Engineers at large companies rarely appear on their employer's website, and some people keep no public profiles at all. Startups close, their domains lapse, and the archive has gaps of its own. Names change with marriage, and transliteration can give one name several spellings in different countries. So keep three outcomes apart. Confirmed means a record the candidate did not write agrees with the claim. Explained means a mismatch has an ordinary cause that you have checked. Open means you found nothing either way, and an open claim moves to the interview and the references. #### Where Sixtyfour fits Checking a resume by hand means working through registries, archives, repositories and programmes, one claim at a time. Sixtyfour's agent starts from what the application already contains, such as the candidate's email address, name or code-hosting username, researches public sources, and links what it finds to the same person. Every finding comes with its source, and anything it could not establish is reported as open rather than filled in. The results go to your hiring team, and a person decides what to ask and whether to proceed. There is more on how hiring teams use it on our [workforce identity page](https://www.sixtyfour.ai/solutions/workforce-identity). #### The short version Write the resume out as claims, and check each one against a record someone else wrote, weighed by who wrote it and when. Confirm details that are not public with the employer or school once the candidate agrees. Mark each claim as confirmed, explained or open, and ask the candidate about the rest before you decide anything. --- ### Shell company red flags: how to check and weigh each one *A crowded address or a busy director proves little on its own. What each red flag is evidence of, how to check it against a primary source, and what it means when several agree.* Source: https://www.sixtyfour.ai/blog/shell-company-red-flags Roham Mehrabi · 2026-10-05 · Trust & Safety The usual shell company red flags are a registered address shared with hundreds of other companies, directors who sit on dozens of boards, a filing history with no sign of trading, a website or phone number much younger than the business claims to be, ownership that runs through other companies without reaching a person, and no trace of staff, premises or customers. Each one has ordinary explanations, because formation agents, virtual offices, holding companies and special purpose vehicles are a normal part of business. To identify a shell company, check each flag against a primary source, work out what it is evidence of, and give weight to the flags that agree with each other and contradict what the company says about itself. This piece takes the flags one at a time, with one invented counterparty throughout. Our guide to [KYB verification](https://www.sixtyfour.ai/blog/kyb-verification) covers the wider onboarding process. This one is about reading the signals. #### What counts as a shell company The 2018 [FATF and Egmont Group report on concealing beneficial ownership](https://egmontgroup.org/wp-content/uploads/2021/09/2018_Concealment_of_Beneficial_Ownership.pdf) gives working definitions. A shell company is an "incorporated company with no independent operations, significant assets, ongoing business activities, or employees". A front company is a "fully functioning company with the characteristics of a legitimate business, serving to disguise and obscure illicit financial activity". A shelf company is registered and left dormant, often to be sold later. Companies with no operations of their own are common in ordinary business. [The Puppet Masters](https://star.worldbank.org/sites/star/files/puppetmastersv1.pdf), a 2011 study by the World Bank and UNODC's Stolen Asset Recovery Initiative, lists mergers, joint ventures, separating liabilities and holding personal or family assets among their legitimate uses. It also found companies used to hide the proceeds of corruption in 128 of the 150 grand corruption cases it reviewed, and in more than half of the cases involving a company, the company was a shell. The FATF and Egmont report calls shell companies the most common type of legal person in schemes to obscure beneficial ownership, and more than half of its 106 case studies specifically referred to them. So the useful question is whether the company's shape fits what it says it does. A holding company with no staff is normal. A wholesaler claiming seven years of trading, with no staff, no premises and a website registered last spring, needs a closer look. #### Shell company red flags at a glance | Red flag | What it can suggest | Where to check | Strength alone | | --- | --- | --- | --- | | Registered office shared with hundreds of companies | A formation agent or mailbox service | Registry search by address | Weak | | Director with a long list of appointments | A professional nominee, or a lent name | The officer's appointment list | Weak to medium | | New officers, name or activity code just before onboarding | A bought shelf company, or a change of control | Filing history | Medium | | Dormant accounts against a claimed trading history | The history did not happen here | Accounts and activity codes | Strong, as a contradiction | | Website or phone number younger than the claimed business | A footprint built for the application | Domain records, certificate logs, web archives | Medium to strong | | Phone number or email shared with other companies | One operator behind several companies | Searches of the number | Medium | | No staff, premises, customers or suppliers | No real operations | Profiles, reviews, job ads, filings | Medium, weak for new businesses | | Ownership that never reaches a person | Concealment, or an ordinary group | Ownership registers, leak databases | Weak to medium | These strengths are a starting point. A flag contradicting something the company told you counts for more than one that merely looks unusual, and two flags that come from the same fact count once. The worked case is invented. In September 2026, Ferrowdale Trading Ltd, a UK private company, applies to a payments company to take card payments as a wholesale distributor of consumer electronics. It says it has traded since 2019 and expects about £350,000 a month in card payments. Its website is ferrowdale.example. The registry shows it as active. #### How many other companies share the registered address? Formation agents, accountants and virtual office providers lend their address to clients. The UK's Office for National Statistics notes that a formation agent ["can register thousands of businesses at a single address"](https://www.ons.gov.uk/businessindustryandtrade/business/activitysizeandlocation/methodologies/multiplebusinessregistrationsatasinglepostcode2020), and the UK government's [guidance on setting up a company](https://www.gov.uk/limited-company-formation/company-address) suggests an accountant's or solicitor's address, or an agent who provides one, to anyone who does not want their home on the public register. In the FATF and Egmont report, the UK said that in practice about 75 percent of its companies are formed by gatekeepers, the professionals who set companies up for others. The same report explains why the address still matters. Companies managed by a service provider "will often share the same bulk address", and large numbers of shell companies "will be registered to the same address and telephone number". To check, search the address in the registry. Companies House's [advanced search](https://find-and-update.company-information.service.gov.uk/advanced-search) takes a full or partial registered office address and filters by incorporation date, which shows whether companies there were formed in batches. A crowded address tells you an agent is involved. It does not tell you which of the agent's companies is the problem. It becomes evidence when the companies there share officers, phone numbers and formation dates with yours. Ferrowdale's registered office is a formation agent's address in London, shared with about 2,300 active companies. On its own, that is context. #### How many boards does each director sit on? A nominee director appears on a company's records while someone else directs it. The OECD's 2001 report [Behind the Corporate Veil](https://www.oecd.org/content/dam/oecd/en/publications/reports/2001/11/behind-the-corporate-veil_g1ghgb3e/9789264195608-en.pdf) describes nominees who "appear as a director on all company documents and in official registries" while the beneficial owner does the directing. Just under half of the FATF and Egmont case studies involved formal nominees, and the report's indicators note that some are "mass" nominees for large numbers of companies. An appointment count is the quick check. Companies House shows a total number of appointments on each officer's page, and its [public data API](https://developer-specs.company-information.service.gov.uk/companies-house-public-data-api/resources/officersearch?v=latest) returns the same figure. The register also shows a director's [month and year of birth](https://www.gov.uk/guidance/your-personal-information-on-the-companies-house-register), which helps separate two people with one name. The count can understate. Companies House [explained in a 2019 reply on its blog](https://companieshouse.blog.gov.uk/2019/07/19/why-its-important-to-use-the-right-data/) that it matches appointments on name, date of birth and residential address, and generally creates a separate record where the details differ significantly. Search the name as well as the record. Then read the list. A family's property companies, a group's subsidiaries or an accountant's clients are ordinary. A run of short-lived companies formed at one address and dissolved within a year or two is a pattern. The FATF and Egmont report adds two cautions. Shared nominees can create "false links between companies", so two companies with the same professional director may have nothing else in common. And scale says little about any one company: in a New Zealand case, one provider supplied nominee directors for over 1,000 companies, and the authorities suspected at least 73 of them of facilitating crimes abroad. Ferrowdale's first director, appointed in 2019, holds about 640 appointments at the agent's address and resigned in June 2026, which fits a company formed for sale. The director appointed in June 2026 holds 23. Nineteen began in the last eighteen months, all at the same address, and eleven of those companies have been dissolved without filing accounts that show any trading. That list is worth keeping. #### What does the filing history say about trading? Read the filing history in date order. Dormant accounts say the company was not trading. The UK government says a company may be [dormant](https://www.gov.uk/dormant-company) if it is "not doing business ('trading')" and has no other income, and Companies House's [list of activity codes](https://resources.companieshouse.gov.uk/sic/) includes 99999, "Dormant Company", and 74990, "Non-trading company". A new name, new officers and a new activity code shortly before a company approaches you can mean a change of control. The FATF and Egmont indicators include "the resignation and replacement of directors or key shareholders shortly after incorporation". That is also the shape of a shelf company sale, after which, the report notes, a new owner can use the company's history "to help secure business relationships or lines of credit". None of this is wrong in itself. Buying a ready-made company is an ordinary shortcut, and plenty of companies sit dormant before they trade. What matters is whether the filings agree with the story. Ferrowdale was incorporated in March 2019 under another name and filed dormant accounts every year to 2025. In June 2026, three months before applying, it changed its name, its director and its activity code. The application says it has traded since 2019, and the filings say it has not, at least not through this company. That is the strongest finding so far, and it is a question the applicant can answer. #### Does the business have an operating footprint? An operating business leaves traces that other people created. The Puppet Masters notes that a company engaged in business "will typically market itself, join a chamber of commerce, build a website", and "will have employees". The FATF and Egmont report lists the reverse among shell indicators: only a post-box address, a lack of personnel, and no taxes or social benefits paid. Date the footprint as well as finding it. - A domain's RDAP record usually carries a registration event, which the [IANA registry of RDAP values](https://www.iana.org/assignments/rdap-json-values/rdap-json-values.xhtml) defines as when "the object instance was initially registered". A re-registration event, where the registry records one, marks a domain registered again later, possibly by someone new. - Certificate Transparency logs [publicly record TLS certificates](https://www.rfc-editor.org/rfc/rfc9162.html) as they are issued, so a domain's first certificate gives a second date for roughly when the site went live. - The Wayback Machine [lists the dates](https://help.archive.org/help/using-the-wayback-machine/) on which it captured a URL. - Search the phone number and email address. A number on several companies' websites links them; our guide to [investigating a phone number](https://www.sixtyfour.ai/blog/how-to-investigate-a-phone-number) covers dating one. - Look for staff whose profiles predate the application, reviews built up over years, suppliers and job ads. Front companies need the opposite reading. They have a footprint by design, so finding one settles nothing. What can give a front away is the FATF and Egmont indicator of "financial activities and transactions inconsistent with the corporate profile", which is often clearer in your own transaction data after onboarding. ferrowdale.example was registered in May 2026, its first certificate was logged that month, and its first archive capture is from July. The warehouse address on the site is the agent's. No staff profiles mention the company, and there are no reviews or trade listings. The site's phone number also appears on the websites of two other companies where the new director sits, and it is not the number the agent publishes for itself. The footprint is about four months old, for a business claiming seven years. #### Where does the ownership chain end? The OECD found that the corporate vehicles misused most often are those that give their beneficial owners the greatest anonymity. Follow the chain until it reaches a natural person or a documented dead end, and note each border it crosses. Where there is a register, start there. The UK lists people with significant control, usually anyone with [more than 25 percent](https://www.gov.uk/guidance/people-with-significant-control-pscs) of the shares or voting rights, or who can appoint or remove a majority of the directors or otherwise influence or control the company. For a foreign parent, check its own registry. The ICIJ's [Offshore Leaks database](https://offshoreleaks.icij.org/), covering more than 810,000 offshore entities, is worth a search, with the ICIJ's own caution that there are legitimate uses for offshore companies and trusts and that many people and entities share names. Jurisdiction alone is a weak signal. In the [Global Shell Games](https://gfintegrity.org/wp-content/uploads/2014/05/Global-Shell-Games-2012.pdf) field experiment, reported in 2012, researchers posing as customers sent more than 7,400 requests to more than 3,700 company formation providers in 182 countries. Nearly half of the replies (48 percent) did not ask for proper identification, and providers in tax havens were significantly more likely to ask than those in OECD countries such as the United States and Britain. Ferrowdale's register names the new director as holding 75 percent or more of the shares. The chain ends at a person straight away, so there is no layering flag. The register cannot say whether that person controls the company or lent it their name. #### Weighing the flags: what held up at Ferrowdale Two findings held up, each on independent sources. - The trading history. Seven years claimed, against dormant accounts every year to 2025 and a domain, certificate and archive record that all start in 2026. The registry and the web are separate sources that agree. - The new director's companies. A run of short-lived companies at the same address, and two of the director's current companies whose websites show the same phone number as Ferrowdale's. The appointments come from the registry and the phone match from the companies' websites, so this is two links. Two flags were context: the crowded address, explained by the agent, and the first director's 640 appointments, explained by a company formed for sale. A search for adverse media on the company and both directors found nothing; our guide to [adverse media screening](https://www.sixtyfour.ai/blog/adverse-media-screening) covers resolving a hit. Three things stay open: who controls Ferrowdale, where its stock is held, and where £350,000 a month would come from. That gives the analyst three requests: evidence of trading before June 2026, such as invoices or bank statements; who bought the company and why; and where the goods are stored. An honest business can answer all three, perhaps by explaining that it bought an aged company and overstated its history. The file records each flag, its source and the reason for its weight, so the decision can be checked later. #### Reading the evidence carefully Most red flags describe normal business shapes, so a fair review checks the ordinary explanation first. - A crowded address is a formation agent's or virtual office's normal output. - Holding companies, special purpose vehicles and group subsidiaries have no staff by design. Judge them by whether the structure fits the group around them. - New and small businesses are thin. Ask them for different evidence: contracts, a lease, the founders' own histories. - What a central registry captures [varies from jurisdiction to jurisdiction](https://star.worldbank.org/sites/star/files/puppetmastersv1.pdf), and a thin result from a thin register says more about the register than the company. - A register records what was filed. A name and a month and year of birth can separate two people, but they do not show that the person named is the one in control. And flags that share a source count once. A long appointment list and a crowded address are often the same fact seen twice, because one agent supplied both. #### Where Sixtyfour fits In a busy queue, the check that gets skipped is often the one that would have contradicted the story. Sixtyfour's agent starts from what the application contains, such as a company name, a director or a website, and researches public sources such as registry filings and the business's web footprint. It links findings to the right company and people, returns every finding with its source, and reports what it could not establish as open rather than filling it in. The results go to your team, and a person decides. There is more on how financial crime teams use it on our [financial institutions page](https://www.sixtyfour.ai/solutions/financial-institutions). #### The short version Treat each shell company red flag as a question with a primary source behind it: count the companies at the address, read each director's appointment list, read the filing history against the story, date the footprint, and follow the ownership to a person. Give weight to independent flags that contradict what the company told you, record the ordinary explanation for the rest, and mark what you could not establish as open. --- ### How to investigate a phone number *Reports often arrive with nothing but a phone number. What it can prove, how to date it, and why today's holder may not be the one you want.* Source: https://www.sixtyfour.ai/blog/how-to-investigate-a-phone-number Hashim Khawaja · 2026-09-30 · Trust & Safety To investigate a phone number, first normalise it to international format and read what the digits can tell you: the country, often a region, and sometimes the type of number. Then find out what kind of line it is today and whether it has moved between carriers, work out how long it has belonged to its current holder, and only then search for where it appears: breach records, listings, filings and accounts. Treat each result with care, because phone numbers are ported, shared and recycled, and the person holding a number today is often not the person attached to its oldest records. #### What a phone number can and cannot prove A phone number feels like a strong identifier. It is short, it is usually verified at signup, and most people keep one for years. For an investigation it has weaknesses that an [email address](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address) mostly does not. A number can move between carriers, and from a mobile network to an internet phone service, without its digits changing. Household landlines, office lines and shared work phones put several people behind one number, and on a family or company plan the account holder is often not the person who uses the line. And numbers that are given up go back into the pool and are issued to someone else, often while the old owner's accounts still point at them. So every finding needs a date, and every link to a person needs a second source. #### Question one: what do the digits say? Start by writing the number in E.164 format: a plus sign, then the country code and the national number, with no spaces or punctuation. E.164 is the ITU's international numbering plan, and it [specifies at most 15 digits](https://github.com/google/libphonenumber/blob/master/FALSEHOODS.md), one to three of them for the country code, though some valid numbers in Germany are longer. Normalising first matters for the same reason it does with email addresses. One number written as (312) 555-0148, 312.555.0148 and +13125550148 looks like three different values in a spreadsheet until someone converts them. The country code is a broad filter. The United States, Canada and several Caribbean islands [all share +1](https://github.com/google/libphonenumber/blob/master/FALSEHOODS.md). And as the [FAQ](https://github.com/google/libphonenumber/blob/master/FAQ.md) of Google's open-source phone number library puts it, many people have phone numbers that do not belong to the country they live in, particularly mobile numbers. That library, [libphonenumber](https://github.com/google/libphonenumber), is widely used for this step, and Android has used it since version 4.0. It parses, formats and validates numbers and can often tell you the type of number from the digits alone. Its documentation is careful about the limits, and they are worth knowing: - A valid number is one from a range that carriers can assign. The FAQ says not to rely on the library to tell you whether a number is currently assigned to anyone or reachable. - In some countries, including the US, mobile, landline and most internet phone numbers come from the same ranges, so the digits cannot tell you which one you have. The library reports those as fixed line or mobile. - Where it has carrier data for a country that allows porting, it returns the carrier originally assigned the number, which may not be the one serving it today. For US numbers it has almost none. So the digits give you a country, a rough region where the numbering plan is geographic (in the US, for mobile and landline numbers alike), and sometimes a type. They do not give you a person, and they do not tell you what network the number is on now. #### Question two: what kind of line is it now? For that you need a lookup against current carrier data, which commercial number lookup services provide. The result usually gives the carrier serving the number today, often the carrier that originally held it, and a line type: mobile, landline, internet phone or something more specialised. Portability is why this is a separate step. The FCC's consumer guide explains that people who switch providers while staying in the same area can [keep their number](https://www.fcc.gov/consumers/guides/porting-keeping-your-phone-number-when-you-change-providers), including moves between landline, internet and wireless providers. When today's carrier differs from the original one, the number has most likely been ported, unless the original carrier has since merged or rebranded. | What the line looks like | What it suggests | What it does not tell you | | --- | --- | --- | | Mobile | Served by a mobile carrier, usually on a phone plan | Who holds it now, or since when | | Landline | Served by a fixed-line carrier, often a home or office line | That the line is at the address you expect | | Internet phone number (VoIP) | Can often be set up and dropped quickly | That anyone is hiding anything, since plenty of people and businesses use them | | Toll-free or premium rate | A business or service line | Anything about an individual | | Invalid or unassigned range | A typo, a formatting error or an invented number | Intent | An internet phone number is easy to over-read. Some can be set up online in minutes, which suits a throwaway identity, but on its own the line type proves nothing. #### Question three: whose number is it now? This question decides whether the rest of the evidence is about the right person. Numbers are reissued on a large scale. Researchers at Princeton who [studied number recycling](https://recyclednumbers.cs.princeton.edu/assets/recycled-numbers-latest.pdf) cite an FCC estimate of around 35 million US numbers disconnected every year. Of 259 numbers on offer to new subscribers at two major carriers that they identified as probably recycled, 171 were still tied to existing accounts at popular websites. So old records attached to a number may belong to a previous holder who has nothing to do with your case. Contact data goes stale the same way: a database that once matched a number to a named person can go on listing that person long after the number has passed to someone else. Date everything. For each record that mentions the number, note when it was created and what name or account it points to. If the records split into an older cluster under one name and a newer cluster under another, you are probably looking at two holders, and only one of them is in your case. #### Question four: where does it appear? Now search, with the number in each of its common formats. Breach data can date a number. The Facebook data scraped in 2019 and leaked in 2021 is a good example: [Have I Been Pwned lists it](https://haveibeenpwned.com/Breach/Facebook) at 509,458,528 accounts, every record in it included a phone number, and only 2.5 million included an email address. Facebook said the data was scraped [before September 2019](https://about.fb.com/news/2021/04/facts-on-news-reports-about-facebook-data/), so, by Facebook's own account, any number in it was on a Facebook profile before then. Have I Been Pwned no longer takes phone numbers in its website search, but its [API still supports them](https://www.troyhunt.com/have-i-been-pwned-2-0-is-now-live/), so a number can be checked without handling the leaked file. Use a breach hit to date a number, not to name its holder. A name in a leaked record is unverified, and it may belong to an earlier holder. Public listings are the other rich source: classified ads, rental and vehicle listings, business directory entries, company filings, and the contact details people once published themselves on forums and personal sites. A number that appears in listings under several different names in a short period is a much stronger signal than any line type. Your own platform counts as well. The same number verifying several accounts, or appearing in several sellers' listings, is a link between them, with the caveats in our guide to [linking related accounts](https://www.sixtyfour.ai/blog/how-to-link-related-accounts). #### A worked example The case below is a composite, and the number in it comes from the 555-0100 to 555-0199 range reserved for fiction, so it does not belong to anyone. A dating platform's trust and safety team receives two reports about one profile. In both, the conversation moved to a messaging app within a day, and a few days later the profile asked for money to cover an emergency. The profile gives its name as Daniel, 41, an engineer in Austin. Its verified phone number is +13125550148. The digits. A US number with a Chicago area code. The digits cannot say whether it is mobile or a landline. A Chicago number on an Austin profile is not unusual in itself, because people often keep their numbers when they move. The line. A current-carrier lookup shows an internet phone provider, while the number was originally held by a mobile carrier. So it has probably been ported. The holder. Two public records, a 2017 forum post and a 2018 business directory entry, list it under a woman's name in Illinois. Nothing ties it to anyone else until this year. Where else it appears. Searching the number in its common formats finds two classified ads posted this year, one for an apartment to rent and one for a car, in two different cities, each asking for a deposit by bank transfer. One is signed Mark and the other Sam, and the car ad reuses a photo from Daniel's profile. Put together, the number had an earlier holder, visible in records from 2017 and 2018, and has been used this year behind at least three names that ask for money, two of them tied together by the same photo. The woman in Illinois is most likely a previous holder rather than a suspect, and the report records her only as that. The team can act on the profile, look for other accounts on the platform verified with the same number, and keep an innocent person out of the case. #### What to leave alone Do not call or text the number. It tells the holder someone is looking, which often leads them to delete the accounts you were about to find, and with a recycled number you may be contacting someone who has nothing to do with the case. Do not pose as someone else to get details from a carrier or from the holder. It can alert the holder, and anything learned that way is hard to stand behind in a report. Do not run lists of numbers through messaging apps' contact discovery. Saving one number as a contact shows you whatever profile the holder chose to make visible, and that is ordinary use. Doing it in bulk is how the Facebook data was collected: Facebook said scrapers used software imitating its app to [upload large sets of phone numbers](https://about.fb.com/news/2021/04/facts-on-news-reports-about-facebook-data/) through its contact importer and see which matched users. In a study published in 2025, researchers at the University of Vienna and SBA Research showed the same weakness in WhatsApp's contact discovery, [confirming more than 3.5 billion accounts](https://www.univie.ac.at/en/news/detail/researchers-discover-security-vulnerability-in-whatsapp), after first reporting the problem to the company. #### The innocent explanations Most of what makes a number look suspicious has an ordinary explanation, and a fair report checks for it first. Shared lines are common. A household landline or an office number reaches several people, so a name attached to it may belong to anyone in the house or on the team. People keep their mobile numbers when they move, sometimes across states and sometimes across countries, so an area code that does not match a stated location proves nothing by itself. A number with almost no public trace is normal for a new number, a new holder, or someone who keeps their details offline. See whether the email address or name it leads to has more history before drawing anything from the silence. And a port or an internet phone line is context. Plenty of people change carriers to save money, and plenty of small businesses run on internet numbers, so neither counts against anyone on its own. #### How Sixtyfour fits Done carefully, the four questions take time, and in a busy queue the first name that turns up can belong to a previous holder. Sixtyfour's agent starts from the number, researches where it appears across public sources, and returns each finding with its source. When a number turns out to belong to someone other than the person it was linked to, it says so, and it reports anything it could not establish as open. From there it can carry on from an email address or a name the number leads to. #### Before you rely on a number Normalise it and read the digits, check what kind of line it is today, date every record so that its holders separate, and only then search. Give each finding a date, confirm each link to a person with a second source, and mark what you could not establish as open. --- ### Adverse media screening: how to review a hit *Many adverse media hits are about someone else, and many of the rest need context. How to resolve a hit, read what it alleges, and record the decision.* Source: https://www.sixtyfour.ai/blog/adverse-media-screening Roham Mehrabi · 2026-09-30 · Trust & Safety Adverse media screening, also called negative news screening, is the search of news and other public sources for negative information about a customer or the people behind it, especially anything that points to financial crime: fraud, corruption, money laundering, sanctions evasion, tax crime and the like. Most of the work is in deciding whether an article is about your customer, what it says happened, and whether any of it changes how you should treat the relationship. This piece follows a single alert through those decisions, one step at a time. For how adverse media fits into checking a business customer as a whole, see our guide to [KYB verification](https://www.sixtyfour.ai/blog/kyb-verification). #### Why so many hits are noise A screening search starts with a name, and names are shared. In the 2010 US Census, [2,442,977 people](https://www.census.gov/topics/population/genealogy/data/2010_surnames.html) had the surname Smith. A search on a common name returns everyone who has it, and a search on an uncommon one still returns anyone whose name is spelled similarly. Names carried between languages and scripts multiply the possibilities. The Wolfsberg Group, an association of global banks, gives an example in its [negative news screening FAQs](https://wolfsberg-group.org/resources/guidances-principles-standards-and-faqs/118): Piotr Czajkowski, Pyotr Tchaikovsky and Piotr Chaykovskiy are the same name, written three ways. Names also appear in different orders, shortened to initials, or with and without a middle name or a second surname, so a system that matches loosely enough to catch every variant also catches a great many strangers. The second source of noise is context. Your customer can be named in an article without being accused of anything. Each hit raises a few questions, starting with whether it is about your customer at all. #### Is the article about your customer? Resolve the identity before you read the allegation. Otherwise a vivid story about a stranger colours everything that follows. The Wolfsberg FAQs separate strong grounds for clearing a hit, such as a clearly different name or a mismatch in a key identifier like date of birth or gender, from weaker ones such as profession or place of residence, which make a match less likely without ruling it out. Compare whatever the article gives you against what you hold: | Identifier | How much it settles | What to watch for | | --- | --- | --- | | Date of birth or age | A lot, when present | Articles give age at the time of the story, so work out the birth year | | City or country | Some | People move, and a city can have many residents with the name | | Occupation or employer | Some, more when an employer is named | Job titles in news copy are loose | | Company name or registration number | A lot, for business customers | Similar company names in other countries | | Other people named | Often decisive | A co-director or family member who appears in both | | Photograph | Some | Low-quality images, and photos of a different person with the same name | Most articles carry only a few of these. A single strong mismatch, such as an age that is twenty years out, is usually enough to clear a hit. Agreement on one weak identifier is not enough to confirm one. #### What part does your customer play in the story? A true identity match still needs reading. Note what role the customer has: the subject of the allegation, a victim, a witness, someone quoted, or a company in the same sector as the one under investigation. Only the first is adverse. The rest are context, and clearing them is quick once you have read the article rather than the snippet. The Wolfsberg FAQs list a customer who is not the subject of the story, such as a plaintiff, as a reason to discount the hit. #### How far did the story get? Every adverse story describes a matter at one point in its life. The Wolfsberg FAQs describe the progression as a "risk stage" that "starts with an allegation, which then likely becomes an investigation which may lead to charges ending with a conviction". A matter can also stop at any point, or end in an acquittal. Plenty stop. In the 2023 fiscal year, US attorneys [declined to prosecute 54 percent](https://bjs.ojp.gov/document/fjs23.pdf) of the fraud suspects in the matters they concluded. In the most recent Bureau of Justice Statistics study of felony cases in the 75 largest US counties, which followed cases filed in May 2009 for a year, [about a quarter of the cases decided within that year ended in dismissal](https://bjs.ojp.gov/content/pub/pdf/fdluc09.pdf). Early stages also tend to get more coverage than outcomes, so a case being dropped can get far less attention than the arrest did. When an article reports an early stage, search for what happened next before you record it: a later report of the outcome, a court record, an official statement, or a correction from the publisher. Record the stage you could confirm, and say plainly when the outcome is unknown. #### One story or ten? Several articles can trace back to a single report. A [2018 study of a year of articles from major Dutch news outlets](https://ijoc.org/index.php/ijoc/article/view/7109) found that at the country's largest news site, three in four articles were based on copy from the largest national news agency, and that much of the online news it studied reused agency text with little or no editing. A press release can also be republished almost word for word by outlets that never checked it. So group the hits that describe the same event in the same words, and trace them back to the first report or the underlying document. A court filing or an official statement carries more weight than a summary of it, and an anonymous blog post or a forum thread carries less than either. The Wolfsberg FAQs describe source credibility in similar terms: content that has been through editorial oversight is generally more credible, content that readers can edit or that reads as opinion is less so, and a report that other reputable sources corroborate is more reliable than one they do not. #### Does it matter for this relationship? A confirmed, adverse, well-sourced story still needs weighing against what the customer is going to do with you, on three things: how serious the matter is, how recent it is, and how relevant it is. Financial crime, corruption and sanctions evasion bear directly on most financial relationships. A decade-old traffic offence does not. On recency, the Wolfsberg FAQs suggest deciding how far back screening should look, and say a multi-year look-back may be appropriate, for all coverage or with longer or shorter periods for different kinds of offence. An old story still counts, and it should be read alongside everything that has happened since. On relevance, an allegation about how someone ran a payments business matters more to a payments provider than the same allegation about their conduct in an unrelated hobby club. #### Writing the decision down Every hit should end in a recorded decision that someone else can follow later, and the Wolfsberg FAQs say procedures should require a recorded rationale for every alert decision, including the ones cleared as false positives. The possible outcomes are few: cleared as a different person, cleared as context, cleared as an unreliable source, noted as a true match that does not change the risk, or escalated for review. The record needs five things: the article and where it came from, the identifiers you compared and the result, the customer's role in the story, the stage the matter reached, and the conclusion with the reviewer's name. With those written down, the decision can be checked, or revisited when the story develops, without starting again. #### One alert, start to finish The alert below is a composite, and the people in it are invented. A payments company is onboarding a sole trader who runs a restaurant in Manchester. The customer gave a full name and a date of birth in 1981. Screening on the name returns fourteen articles. Nine are about a local politician with the same name in another country, aged in his sixties. The age and the country both differ, so all nine are cleared as a different person in one step. Two are local news stories about a burglary at a restaurant whose name matches the one on the application, and the customer is quoted as its owner. Right person, but the customer is the victim. Cleared as context. The remaining three describe a man with the same name, aged 38 in 2019, who was charged that year with fraud connected to a restaurant business in Manchester. An age consistent with a 1981 birth, the city and the trade all fit, so this is treated as a probable match, with the supporting identifiers recorded. On reading, the three articles are one wire report carried by three sites, which makes it one source rather than three. A search for the outcome finds a short court report from 2020 saying the case was discontinued. So fourteen hits come down to one relevant story, probably about the customer, which reached a charge and was then dropped. The file records each step: which hits were cleared and on what grounds, which report the three articles came from, and the court report on the outcome. The case goes to a reviewer with the question already narrowed to one thing: whether a case discontinued in 2020 changes anything for this account. #### Screening every customer fairly A screening process can end up treating some customers worse than others for reasons that have nothing to do with risk. Some names are shared by far more people than others, and names from some languages have more spelling variants in Latin script. Customers with those names will generate more hits, so judge each hit on what it shows rather than on how many there are. The number of hits mostly reflects how common a name is and how often the people who share it make the news. On its own it says little about risk. Results also age. A customer who was clean at onboarding can appear in tomorrow's news, and one who was once charged can have been cleared since. Re-screen on a schedule that matches the risk, and re-read old true matches when you do. #### Where Sixtyfour helps Sixtyfour's agent does the research behind each hit. It searches news and records for potentially adverse coverage of a customer and the people behind it, and puts each result beside the identifiers that support or weaken the match, with its source attached. Anything it could not establish is reported as open. Your analysts review the evidence, and the decision about the relationship stays with them. --- ### How to evaluate AI tools for investigations *AI research agents can take on much of an investigation's legwork. Five checks tell you whether their results will hold up when someone asks how you know.* Source: https://www.sixtyfour.ai/blog/ai-tools-for-investigations Saarth Shah · 2026-09-30 · Trust & Safety AI tools for investigations are research agents that start from an identifier, such as a name, an email address, a username, a phone number or a company, and search public sources to build a sourced picture of who or what is behind it: accounts, records, connections and adverse media. They take on much of the collection and cross-referencing an analyst would otherwise do by hand. Before relying on one, check five things: that every finding carries a source you can open, that it says "unknown" instead of guessing, that it tells apart people who share a name, that its collection stays passive, and that it gets cases right when you already know the answer. By investigations, this piece means people and company investigations: trust and safety, fraud, due diligence, hiring and open-source intelligence work. #### What these tools do well Much of an investigation's time goes on collection: searching one identifier across dozens of sources, following it to the next identifier, reading records in other languages, and noting where each fact came from. That work is repetitive, and it grows with every identifier you follow. This is the part an agent is good at. It can run many searches at once, pivot from an email address to a username to an old forum account without losing the thread, read a scanned filing, and hand back a structured result with its sources attached. Our guides to [investigating an email address](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address) and [spotting fake candidates](https://www.sixtyfour.ai/blog/how-to-spot-fake-candidates) show what that collection involves when it is done by hand. The judgement stays with the investigator: whether a link is strong enough to act on, what a finding means for the case, and what happens to the person or company at the end of it. The agent collects and organises, and the investigator decides. #### Five checks before you rely on one ##### 1. Every finding has a source you can open Citations only help if you open them, because a sourced finding can still be wrong. Check that each page says what the tool says it does. A [2025 study involving 22 public service media organisations](https://www.ebu.ch/news/2025/10/ai-s-systemic-distortion-of-news-is-consistent-across-languages-and-territories-international-study-by-public-service-broadcaste) shows why. It found serious sourcing problems, meaning missing, misleading or incorrect attributions, in 31 percent of the answers that four widely used AI assistants gave to news questions. Those were general assistants rather than investigation tools, but the failure is the same one to test for. Test it directly. Take twenty findings from a few results, open every source, and count how many support the claim as written. Watch for the near misses: a real page that mentions a different person with the same name, or an article that says something weaker than the summary above it. Sources need dates as well, because pages change and come down, and a finding is only as current as the day its source was read. The [Berkeley Protocol on Digital Open Source Investigations](https://www.ohchr.org/sites/default/files/2024-01/OHCHR_BerkeleyProtocol.pdf), published by the UN human rights office and UC Berkeley's Human Rights Center, asks human investigators to record the search paths that led to each piece of material, when and by whom it was collected, and their method in enough detail that someone else could repeat it. A tool that does the searching for you should keep that record for you. ##### 2. It says "unknown" instead of guessing For an investigator, a blank field is cheap and a wrong one is expensive. A blank tells you to keep looking. A confident wrong answer can end up in a report. Language models lean the other way by default. A [2025 paper on why language models hallucinate](https://arxiv.org/abs/2509.04664) argues that standard training and evaluation reward a confident guess over an admission of uncertainty. The broadcasters' study above found major accuracy issues, including hallucinated details and outdated information, in 20 percent of the answers it reviewed. So test for restraint as well as recall. Include a few subjects with thin public footprints and see whether the tool returns gaps or fills them. The result you want is a list of what was established, what was not, and why. ##### 3. It gets the right person among people who share a name In the 2010 US Census, [2,442,977 people](https://www.census.gov/topics/population/genealogy/data/2010_surnames.html) had the surname Smith, and each of the ten most common surnames was shared by more than a million people. A wrong identity match is one of the most expensive mistakes in people research, because everything found after it belongs to someone else. A good tool anchors to what you already know, such as an employer, a city, an email address or a date of birth, and explains why each new account or record belongs to the same person. Test it with a subject whose name is common, and with one who has a namesake in the same field or city. Read the reasons it gives for each link, not only the links. ##### 4. Collection stays passive Open-source collection should not touch the subject. The Berkeley Protocol draws its definition of open source information along that line: such information "does not involve interacting with or soliciting information from individual Internet users". For a tool, that rules out logging into the subject's accounts, triggering password resets, messaging people, or anything else that would tell someone they are being looked at or that relies on access nobody authorised. Ask the vendor directly what the tool does to collect, and look for anything in the output that could only have come from an active step. Ask where your queries go as well. The names and identifiers you search are sensitive in their own right, and you should know how long they are kept and who can see them. ##### 5. It holds up on cases you already know Your own closed cases make the best test, because you know what the right answer was and how hard it was to find. The next section sets out how to build one. Run the same case twice as well. Systems built on language models can give different answers to the same question even with settings meant to make them repeatable, and a [2024 study of "deterministic" model settings](https://arxiv.org/abs/2408.04667) measured variations in accuracy of up to 15 percent across runs on standard benchmarks. Some variation is normal, and it should sit at the edges of a result, such as an extra old account found one time and not the other. The core identity should not change between runs. #### Build your own test set Twenty to thirty closed cases should surface most of a tool's failure modes. Pick them so that each one tests something specific: | Include | What it tests | | --- | --- | | Subjects with rich public footprints | Recall, and whether sources are cited properly | | Subjects with thin footprints | Whether the tool reports gaps instead of filling them | | Common names, and pairs of people who share a name | Identity resolution | | An identifier that changed hands, such as a recycled phone number or a reassigned work email address | Whether the tool checks dates before linking | | Names in other scripts or languages | Transliteration and non-English sources | | A company with a similarly named counterpart | Entity resolution for organisations | Score every field as correct, wrong or missing, and weigh a wrong answer as worse than a missing one. Separately, count the citations that do not support the claim they are attached to. The first half of that is how RECON scores. RECON is the people research benchmark we built, externally validated by HUD, and it covers 140 real people and 514 verified fields, with roughly a quarter of the people paired with a same-named decoy. Its headline metric is weighted accuracy: correct answers minus wrong answers, divided by every field. A wrong answer costs a point, and a blank costs nothing. Every system tested so far, ours included, has given some wrong answers, so a person should read the result before anyone acts on it. The [latest results and methodology](https://www.sixtyfour.ai/recon-benchmark) are on the benchmark page. #### What Sixtyfour's agent returns Sixtyfour builds AI research agents for people and company investigations. The agent starts from the identifiers you have, such as a name, email address, phone number or company, researches across public records, breach records, social profiles, code hosting, forums, archived pages, filings and news, and returns findings with a source attached to each one. It says which accounts and records it believes belong to the same person and why, and reports what it could not establish as open rather than filling it in, so an investigator can check every finding before acting on it. #### The checks, in brief - Open the sources. Count how many support the claim as written, and check they are dated. - Give it thin footprints and see whether it admits gaps. - Give it common names and pairs of people who share a name, and read its reasons for each link. - Ask what it does to collect, and where your queries go. - Run your own closed cases, twice, and score wrong answers as worse than blank ones. Run these checks on your own cases and you will know where a tool's results can be trusted and where a person still needs to look. --- ### How to link related accounts in a trust and safety investigation *Shared IPs, devices and cards connect accounts, and they also connect strangers. How to weigh each link, and when a cluster is really one operator.* Source: https://www.sixtyfour.ai/blog/how-to-link-related-accounts Julian Wong · 2026-09-29 · Trust & Safety To link related accounts, list every value the accounts share, weigh each shared value by how many other accounts on your platform also have it, and count only links that come from independent evidence. A payout account shared by two accounts is a strong link. An IP address shared with thousands of other users is barely a link at all. Treat a set of accounts as one operator when at least two strong, independent links agree, and keep everything weaker as a lead. Common linking mistakes come from skipping one of those steps: a cluster built on a busy IP address, a ban that swept up someone's flatmate, a "ring" that turned out to be one university library. #### What linking is for Much of the abuse that costs a platform money runs on more than one account. A banned seller comes back under a new name. One person claims a sign-up promotion forty times. A group of accounts reviews each other's listings, or passes money around until one of them cashes out. Handled one account at a time, each of these becomes a queue that never empties, because the operator opens the next account. Linking moves the unit of work from the account to the person or group behind it. It also raises the cost of getting it wrong. A false link punishes someone for another person's behaviour, and they rarely find out why. #### The signals, and what each one proves | Shared value | Why it links accounts | Common innocent reasons | Starting weight | | --- | --- | --- | --- | | Payout bank account or card | The money has to reach someone | Family members, a small business paying out to one account | Strong | | Verified phone number | Verification needed the number at that moment | Recycled numbers, a shared family phone | Strong when the dates are close | | Email address, after normalising | One inbox receives both accounts' mail | Shared family or business inboxes | Strong | | Profile or listing photo | The same file was uploaded twice | Stock images, copied listings, and photos taken from someone else | Medium, and it never links the person pictured | | Device identifier or fingerprint | The same machine was used | Shared household devices, public computers, very common configurations | Medium | | Distinctive username or naming pattern | People reuse handles | Common words and first names | Weak to medium, depending on rarity | | IP address | The same network was used | Mobile networks, shared carrier addresses, offices, public wifi, VPNs | Weak | | Timing and behaviour | The same habits | Time zones and ordinary routines | Weak alone, useful as support | Normalise identifiers before comparing them. Gmail [ignores dots](https://support.google.com/mail/answer/7436150) in Gmail addresses and delivers mail sent to [name+anything](https://support.google.com/mail/answer/22370) to the same inbox, so one person's accounts can look like several until the addresses are normalised. The dot rule only covers consumer Gmail addresses, though. Dots do matter in work and school addresses hosted by Google, so normalising every Google-hosted domain the same way creates false links. Treat the weight column as a starting point. Three things move it: how rare the value is, whether the link is independent of the others, and when each account used it. #### Rarity sets the weight A shared value links two accounts in proportion to how few other accounts share it. So before drawing a line between two accounts, count how many accounts on your platform have that value. Call it the fan-out. Start with IP addresses. An IETF document on carrier-grade NAT defines it as a way to [share the same IPv4 address among several subscribers](https://www.rfc-editor.org/rfc/rfc6888.html), and a [2016 measurement study](https://arxiv.org/abs/1605.05606) found it in more than 90 percent of the cellular networks it examined. Another IETF document, on the [problems address sharing causes](https://www.rfc-editor.org/rfc/rfc6269.html), states the consequence: an address and a time are not enough to identify one subscriber when the address is shared. Researchers who studied [sockpuppets in online discussion communities](https://arxiv.org/abs/1703.07355) removed the most heavily used IP addresses before they started, because the accounts behind them may simply have been sitting behind a country-wide proxy or an intranet. Device fingerprints are more distinctive than IP addresses, but less so than their reputation suggests. According to a [survey of browser fingerprinting research](https://arxiv.org/abs/1905.01051), the early studies that found more than 80 percent of browsers unique drew on privacy-conscious volunteers, while a 2018 study of about two million fingerprints collected on one of the top 15 French websites found only 33.6 percent unique, and 18.5 percent on mobile. Fingerprints also drift: in one long-running study, nearly half had changed at least once after a single day. Record linkage weighs agreement by rarity. The model Ivan Fellegi and Alan Sunter formalised in 1969, which a [US Census Bureau research report on record linkage](https://www.census.gov/content/dam/Census/library/working-papers/2006/adrm/rrs2006-02.pdf) starts from, scores a pair of records by how likely its pattern of agreement is among true matches compared with non-matches, and can weight agreement on a name by how common that name is. It also sorts pairs into three groups rather than two: matches, non-matches, and possible matches held for a person to review. A shared surname of Smith tells you less than a shared surname of Tarvelle, and a shared IP address tells you less than a shared payout account, for the same reason. Usernames follow the same rule. In a [2011 study of linking usernames](https://www.freehaven.net/anonbib/papers/pets2011/p1-perito.pdf), johnsmith and johnsmith82 were too common to link despite looking alike, while daniele.perito and d.perito could be linked despite looking less alike. So record the fan-out beside every link. A value shared by two accounts is evidence. A value shared by two thousand is background. #### Two links from one fact count once Links only add up when they come from independent evidence. The same IP address and the same city are one observation, because the city came from the IP address. A shared email address and a username copied from its first half, such as jsmith82@ and @jsmith82, are one observation too, because one was made from the other. For each new link, ask whether it would still be true if the first link turned out to be a coincidence. If a flatmate explains the shared IP address, the same flatmate probably explains the shared device fingerprint. A shared payout account is less exposed, because a flatmate rarely shares a bank account, though a family member might. #### When each account used it Every link has a date, and the date changes what it means. Two accounts on one IP address in the same hour are a different finding from two accounts that used it eleven months apart. Phone numbers need particular care. Princeton researchers who [studied number recycling](https://recyclednumbers.cs.princeton.edu/assets/recycled-numbers-latest.pdf) cite an FCC estimate that around 35 million US phone numbers are disconnected and placed back in the pool every year. When they sampled 259 numbers available to new subscribers at two major carriers, 171 were still tied to existing accounts at popular websites. A number that verified one account in 2019 and another in 2025 may have belonged to two different people. Activity timing can support a link, though it rarely proves one alone. The sockpuppet study above combined it with network data to identify likely sockpuppets: posts from the same IP address, in the same discussion, within 15 minutes of each other, in at least three different discussions. Creation order carries information as well. A new account that appears the day after a ban, from the banned account's device, is the pattern ban evasion leaves. Two accounts that have sat quietly on the same home connection for five years are more likely to be a couple. #### Reading a cluster fairly Many of the false links a platform will draw come from a short list of ordinary situations. Households, shared flats, offices and student halls put many real people on one connection, and often on one device. People share accounts too. In a 2016 Pew Research Center survey, [41 percent of American online adults](https://www.pewresearch.org/internet/2017/01/26/2-password-management-and-mobile-security/) said they had shared the password to one of their accounts with friends or family, and in a 2013 survey, [27 percent of internet users](https://www.pewresearch.org/internet/2014/02/11/couples-the-internet-and-social-media/) who were married or in a committed relationship shared an email account with their partner. Mobile networks, and some home broadband providers, put unrelated customers behind the same public address, so a shared IP address from a carrier range says very little. People use VPNs for privacy, travel and work, and a popular VPN exit address is shared by strangers all over the world. Recycled phone numbers connect a new owner to an old owner's accounts. A stolen photo links the accounts of whoever uploaded it. The person in the picture is usually a victim, and treating them as part of the cluster turns the victim into a suspect. An account takeover is the hardest case. A hijacked account starts to share devices and networks with the attacker's other accounts, but its original owner did nothing wrong. When an old, quiet account suddenly joins a cluster, look for a password reset, a new email address or a first login from a new device before you act on it. Wikipedia, which runs its sockpuppet investigations in public, is careful about the same thing. Its [CheckUser policy](https://en.wikipedia.org/wiki/Wikipedia:CheckUser) says the tool "is not magic wiki pixie dust", and adds: "An editing pattern match is the important thing; the IP match is really just extra evidence (or not)." Its [sockpuppetry policy](https://en.wikipedia.org/wiki/Wikipedia:Sockpuppetry) warns that people who use the same computer or network connection risk being accused of running each other's accounts. #### One cluster, worked through This case is a composite, and every account in it is invented. A marketplace bans a trading-card seller for shipping counterfeits. Over the next three weeks, four new seller accounts register in the same category. Account A pays out to the same bank account as the banned seller, and only these two accounts have ever used it. A's first login, the morning after the ban, also came from the banned seller's device. Only three accounts have ever used that device, and the third is account D. At a fan-out of three, a link the table starts at medium counts as strong here. A household could explain a shared bank account and a shared device, but not a new seller account that opens on that device the morning after the ban and sells the same cards. A has two strong links, independent of each other. Account B shares a device fingerprint with a second phone that account A logs in from. That fingerprint also matches 38 other accounts, because it belongs to a popular phone model with default settings, and B shares nothing else. B stays unlinked, and the fingerprint is kept as a lead. Account C used the same IP address as the banned seller. The address belongs to a mobile carrier and appeared on thousands of accounts that month, so it is not a link. Account D lists twelve product photos that are byte-identical to the banned seller's old listings. On its own that could be a copycat lifting someone else's images, so it counts as support rather than as a link. D has two strong ones. It logged in from the banned seller's device, the one only three accounts have used. And its verified phone number, which no other account uses, appears in a trading-card classified ad posted a month before the ban and signed with the banned seller's username. That username is unusual, and no one else on the classifieds site uses it, so the ad ties D's number to the banned seller. So A and D go to review together as the same operator as the banned seller, with every link and its fan-out attached. B and C stay unlinked, and the file says why. #### Where the platform's data stops Apart from D's classified ad, everything so far uses signals your platform collected itself. They answer one question well: which accounts here share money, devices, numbers and networks. They cannot tell you who is behind a cluster, or whether the same person runs accounts on other platforms. Both questions are answered outside your systems. The handle from a banned account turns up on a forum. The phone number on a new seller's listings appears in older ads with a name attached. An email address sits in a breach record next to a username used on other sites. Each of these connects accounts that share nothing inside your platform, and each needs the same discipline: how rare is the shared value, and is it independent of the other links. Our guide to [investigating an email address](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address) goes further into tracing one identifier off-platform. #### Writing the link down Write each link down as you make it, so someone else can check it later and it can be undone cleanly if it turns out to be wrong. For each one, record the shared value, its type, when each account used it, its fan-out, and which other links it depends on. Then match the action to the evidence. A cluster held together by strong, independent links can support a ban. A cluster held together by weak ones supports a step-up check, a limit, or a closer look. Keep actions reversible where you can, and let a person make the final call. #### Where Sixtyfour comes in Your platform holds the device, network and payment data, and linking on those belongs in your own systems. Sixtyfour works on the half that lives outside them. Starting from an account's email address, phone number, username or name, the agent traces where each identifier appears across public sources, works out which of those appearances belong to the same person, and reports every link with its source and the reason it believes the link holds. Anything it could not establish is reported as open. The results come back to your team, and a person decides what happens next. There is more on how trust and safety teams use it on our [trust and safety page](https://www.sixtyfour.ai/solutions/trust-and-safety). --- ### KYB verification: checking a business is real, not just registered *A KYB check can confirm that a company was registered. The harder part is showing that it trades, who controls it, and that the bad news you found is about it.* Source: https://www.sixtyfour.ai/blog/kyb-verification Roham Mehrabi · 2026-09-24 · Trust & Safety KYB verification is the work of confirming that a business customer is who it says it is. In practice that means three things: showing that the business exists and operates, identifying the people who own and control it, and screening the business and those people for sanctions and adverse media. KYB tooling is good at the first step: confirming that a company with a given name and number appears on a registry. Most of the risk sits in the rest. This piece walks through each part, the point where each one usually stops short, and what it takes to close the gap. It uses one worked example throughout, the same one on our [financial institutions page](https://www.sixtyfour.ai/solutions/financial-institutions). #### What a registry match proves A company registry records what was filed with it. Filing is not the same as verification, and some registries say so outright. The UK's Companies House is one. Its [service information](https://resources.companieshouse.gov.uk/serviceInformation.shtml) explains that it checks documents are complete and signed but has no power to verify what they say, and that a filing on the register "should not be taken to indicate that Companies House has verified or validated it". That is changing. Since [18 November 2025](https://www.gov.uk/government/news/companies-house-confirms-identity-verification-rollout-from-18-november-2025), new directors and people with significant control have had to verify their identity, with existing ones brought in over a transition that runs to late 2026. It is a real improvement, and what it verifies is the people named on a filing. It does not verify that the company trades. In the US, companies are formed at state level, and formation agents let one street address serve as the registered office for a very large number of entities. A [2012 New York Times investigation](https://www.nytimes.com/2012/07/01/business/how-delaware-thrives-as-a-corporate-tax-haven.html) found at least 285,000 businesses using a single building in Wilmington, Delaware, as their legal address. There is nothing wrong with that. It is how registered agents work. But it does mean that the address on a filing tells you where the paperwork goes, not where the business is. So a registry match establishes that an entity with that name and number was formed and, usually, that it is still in good standing. It is necessary. It says nothing about whether the company trades, how long it has traded, or who is really behind it. A shelf company bought last month, a dormant entity reactivated for one purpose and a genuine twenty-year-old distributor all return the same clean match. #### Part one: corroborate that the business operates An operating business leaves traces it did not create for the purpose of passing a check. Those traces are what corroboration looks for. The website is the obvious start, and the questions are about age and consistency rather than existence. When was the domain registered, and does that date sit sensibly against the incorporation date and the history the applicant describes? Does the site describe the same business as the application and the registry's activity code? Is the contact address the registered agent's address, or somewhere goods could plausibly be stored and shipped from? Beyond the website, look for evidence that other people have dealt with the business over time: customer reviews that build up over years rather than arriving in a single week, job postings, and staff whose professional profiles predate the application and name the company. Trade directory listings and supplier mentions help, and so do filed accounts whose size fits the turnover the applicant expects to put through your platform. Contradictions are more useful than confirmations. A company claiming ten years of trading on a domain registered this spring. A product catalogue made of stock photos with placeholder text still in the footer. A warehouse address that turns out to be a virtual office. None of these proves fraud. Each is a question the applicant can answer, and an honest business usually answers it easily. "Not established" is a legitimate result. If the registry supports the legal identity and the website is real but nothing shows the business operating before this year, the finding is exactly that, and it should be recorded as an open question rather than rounded up to a pass or down to a fail. #### Part two: find the people behind it Start with who counts. The usual definition of a beneficial owner is every individual who owns 25 percent or more of the business, plus one individual with significant responsibility to control or manage it. Definitions vary from country to country, and higher-risk customers often justify looking below the threshold. Where the ownership information comes from matters as much as the threshold. Public ownership registers help where they exist. The UK publishes people with significant control on the Companies House register, which is a useful start and carries the same caveat as everything else filed there. Elsewhere, what you can see varies a great deal from country to country, and for many companies there is no public register to check at all. The practical consequence is that ownership usually arrives as a declaration from the customer, and the work is corroborating it. Follow each layer of the structure until it reaches a natural person or a documented dead end. A holding company is one more layer to follow, and one registered in another jurisdiction may have filings you cannot read, which is itself worth recording. Two patterns are worth watching for: nominee officers and directors supplied to fill every office on the public record, and a business that gives only a registered agent's address. The most common error in this part is treating a shared name as a connection. The applicant's director and a director of some other company have the same name. That is a lead. It becomes a link when something besides the name matches: a date of birth where the registry publishes one, a service address, a co-director who appears on both, the same formation agent, the same correspondence address, or a signature pattern across filings. Until then it stays in the report as a name match, clearly labelled, and it does not go into the risk score as though it were a finding. Our field brief on [tracing hidden beneficial owners behind shell companies](https://www.sixtyfour.ai/blog/how-we-trace-hidden-beneficial-owners-behind-shell-companies) goes further into the layered structures this part runs into. #### Part three: screen, then resolve before you escalate Sanctions and politically exposed person screening is list-based, and it is the part of KYB with the most mature tooling. Adverse media is different. It searches unstructured news and records for negative coverage of the business and its owners, and its main failure is volume. The volume comes from matching names. A search for a company name returns every article about every business with a similar name, and a search for a director returns every person who shares theirs. [Industry guidance on negative news screening](https://wolfsberg-group.org/resources/guidances-principles-standards-and-faqs/118) describes discounting a hit as a false positive where the names differ significantly or where secondary identifiers such as a date of birth or a date of incorporation do not match. The fix is to resolve the entity before treating a hit as relevant. For a business, that means checking the jurisdiction, the registration number, the named directors, the dates and the industry in the article against the customer. For a person, it means the identifiers the article carries, which is often not many. A hit that survives resolution then needs weighing by what it actually says: an allegation, an investigation, a charge and a conviction are four different things, and a single report repeated by ten outlets is still one report. Keep three things separate in the file: the article, the reasoning for why it does or does not refer to your customer, and the analyst's conclusion. When anyone reviews the case later and asks why it was cleared, that separation is what answers them. #### A worked example The case below is a composite, and the business in it is invented. Brantholm Trading applies for a merchant account as an industrial equipment distributor. The KYB API returns a clean registry match: the legal name on the application matches the filing, the company is active, the registered office is on file. Corroboration. The trading website exists and has a product catalogue and contact details, which fits the application. Nothing yet shows how long the business has been trading, so operating history goes down as not established. Ownership. The filing names one direct shareholder, Brantholm Holdings, and one director, Alex Morgan. The holding company is a second layer to follow. The director's name also appears on another company's filing. Nothing else on the two filings matches yet, so it is recorded as a name match to review, not as a connection. Adverse media. One article describes a commercial dispute involving Brantholm Trade BV. The name is close, but the article's company is registered in a different jurisdiction from the applicant and none of its named people appear on Brantholm Trading's filing. Resolved as a different entity, with the reasoning kept beside the article. What comes out is a legal identity that checks out, an operating history that is not yet established, an ownership structure followed one layer down with one unresolved name, and an adverse media hit that was about someone else. That gives the analyst a short, specific list of what to ask the customer for, before anyone has decided anything. #### How deep each check should go Not every business customer needs every step at full depth, and a KYB programme that treats a local bakery like an offshore payment processor will be slow for the bakery and no safer for it. The usual approach is to set depth by risk. Registry, ownership declaration and screening for everyone. Deeper corroboration and full ownership tracing when something raises the risk: a high-risk industry, owners or parents in other jurisdictions, a structure more complex than the business seems to need, answers that do not fit the evidence, or expected volumes that do not fit the size of the company. #### Reading the results fairly New businesses are legitimately thin. A company incorporated last month has no trading history to find, and treating youth as a red flag rejects every genuine startup. For a new business, ask for different evidence: the founders' own histories, signed contracts, a lease. Small businesses may have almost no online presence. Many sole traders and trades businesses have no website and never will. Registries differ a great deal in what they publish and how current it is, and some jurisdictions publish very little. A thin result from a thin registry says more about the registry than the company. Names collide, and transliteration makes it worse. A name written in another script can be spelled several ways in Latin letters, and common names generate matches no amount of tuning removes. Resolution by other identifiers is the only real answer. And KYB goes stale. Ownership changes, directors resign, a dormant company is sold. A check that was right at onboarding describes that moment, not the customer you have today, so it is worth running again when something changes: a new owner or director, a jump in volume, or anything that calls the earlier picture into question. #### Where Sixtyfour fits A KYB API confirms that an entity is registered and that its documents are genuine, and it should stay in your stack. Sixtyfour works on the questions a registry match leaves open. Starting from what the application already contains, the agent researches the business's operating footprint, follows directors, shareholders and connected entities across filings, and puts potentially relevant adverse media beside the identifiers that support or weaken the match. Every finding carries its source, and anything it could not establish is reported as open rather than filled in. It adds investigative context to your screening and case review. It is not transaction monitoring and it does not make the decision. --- ### How to detect synthetic identity fraud *A synthetic identity passes KYC because every piece of it checks out. What it usually lacks is the past a real person builds up without trying.* Source: https://www.sixtyfour.ai/blog/how-to-detect-synthetic-identity-fraud Julian Wong · 2026-09-23 · Trust & Safety Synthetic identity fraud is hard to detect because every piece of a synthetic identity can check out on its own. The Social Security number is valid, the credit file exists, the address receives mail and the phone number answers. To find one, stop checking the pieces one at a time and ask whether a life surrounds them. Does the identity have the age, the incidental history and the connections to other people that anyone accumulates without meaning to? A synthetic identity is built to pass inspection. It is rarely built to have a past. #### What a synthetic identity is The Federal Reserve's [industry-recommended definition](https://fedpaymentsimprovement.org/strategic-initiatives/payments-security/synthetic-identity-payments-fraud/synthetic-identity-fraud-defined/) is the use of a combination of personally identifiable information to fabricate a person or entity in order to commit a dishonest act for personal or financial gain. In the US the usual recipe is a real Social Security number combined with a name and date of birth that belong to nobody. The number is typically taken from someone without an active credit profile, and the Fed notes that [children's numbers are the favourite](https://fedpaymentsimprovement.org/wp-content/uploads/protect-kids-from-synthetic-identity-fraud.pdf), because they usually go unused until the child's late teens and almost nobody is watching them. Because the person does not exist, nobody checks the identity's credit report or disputes a charge on its accounts. The crime still has a victim. As the [Boston Fed points out](https://www.bostonfed.org/news-and-events/news/2022/08/synthetic-identity-fraud-is-not-a-victimless-crime-costs-billions-damages-lives.aspx), the real owner of the number, often a child, can find their credit ruined and not learn about it until they are old enough to apply for credit or a job. What the fraudster relies on is the silence in between, and it can last for years. #### How a synthetic identity gets a credit file The credit bureaus create the file themselves. As the Boston Fed describes it, the first application in the new identity's name is usually rejected, because there is no credit history. But the lender's inquiry leaves the bureau holding a file for the identity. The fraudster keeps applying until a lender approves something small, and from then on the identity builds a record like anyone else. The record can be accelerated. The Fed describes fraudsters adding a synthetic identity as an authorised user on well-established accounts with high credit limits, a practice it calls [piggybacking](https://fedpaymentsimprovement.org/wp-content/uploads/spot-a-synthetic.pdf), so the new identity inherits years of someone else's repayment history. The real account holder is sometimes paid to allow it. Then, usually after months or years of on-time payments, the identity borrows as much as it can across every account it holds and stops paying. The Fed's term for this is [busting out](https://fedpaymentsimprovement.org/wp-content/uploads/frs-synthetic-identity-payments-fraud-white-paper-july-2020.pdf): maxing out a line of credit with no intention to repay. The Federal Reserve's own toolkit makes the point that matters most for detection: until that moment, a synthetic identity in a portfolio [often behaves like a model customer](https://fedpaymentsimprovement.org/resources/synthetic-identity-fraud-mitigation-toolkit/how-synthetic-identities-are-used/), and once the loss happens there is often nothing to show it was fraud. It looks like a real customer who could not pay. Credit bureau data put US lenders' exposure to suspected synthetic identities, across auto loans, bank and retail credit cards and unsecured personal loans, at a [record $3.3 billion](https://www.transunion.com/report/h1-2025-omnichannel-fraud-report) at the end of 2024 and [$2.7 billion](https://www.transunion.ca/content/dam/transunion/ca/business/collateral/report/canada-h2-2025-fraud-trends-update-report.pdf) at the middle of 2025. #### Why the usual checks pass it A typical KYC check asks whether the name, date of birth, address and Social Security number on an application appear together in credit and data sources. After a few months of applications, they do. The bureaus and data brokers hold the identity because the fraudster's own activity put it there, so a check that compares data against data is checking the synthetic identity against itself. The Fed's detection guidance says as much: synthetic identities [often pass KYC verification](https://fedpaymentsimprovement.org/resources/synthetic-identity-fraud-mitigation-toolkit/detecting-a-synthetic-identity/). Document checks stop crude attempts. Where a document is needed at all, a good forgery or a generated one can get through, and many digital onboarding flows never ask for one. Behavioural and credit models see perfect repayment right up to the bust-out, because the repayment is real. There is nothing wrong to see until there is a lot wrong all at once. One older check stopped working in 2011. Until that June the first three digits of a Social Security number tied it to the state that issued it, and numbers were assigned in a known sequence, so a number could be tested for plausibility against an applicant's age and where they said they grew up. The Social Security Administration's [randomisation](https://www.ssa.gov/employer/randomization.html) ended both, and that plausibility test went with them for every number issued since. The strongest single control in the US goes to the source. The Social Security Administration's [eCBSV service](https://www.ssa.gov/dataexchange/eCBSV/), rolled out from late 2020, lets banks and other financial institutions check, with the customer's written consent, whether a name, date of birth and Social Security number match SSA's records, and tells them which element does not. It catches the most common recipe, a real number under an invented name, and any lender that can use it should. It also has limits. SSA says plainly that it [does not verify a person's identity](https://www.ssa.gov/news/en/press/releases/2020-10-29.html): it confirms that three pieces of data belong together. It depends on a Social Security number and the customer's consent, and it does nothing for the many platforms that onboard people without collecting a Social Security number at all: marketplaces, gig platforms, many payments and crypto products, and anyone outside the US. #### What a real identity has that a synthetic one does not Set the data aside and look at the life around it. Three things are hard to manufacture. Age that agrees with itself. A real adult's email address, phone number, address history, credit file and online presence all start at different times, most of them long before today's application. A synthetic identity's traces tend to begin together, at roughly the moment it started applying for credit. Incidental presence. Real people leave traces they never curated: a review of a local garage, a name on a race results page, a post in a hobby forum, an old account on a service nobody uses any more. None of it was created to prove anything, which is exactly why it is expensive to fake. We made the same argument about [fake job candidates](https://www.sixtyfour.ai/blog/how-to-spot-fake-candidates), and it holds for the same reason. Other people. A real person is connected to other real people: relatives at the same address over many years, colleagues who list the same employer, a partner on a lease. A synthetic identity's connections are thin, or they loop back into the other identities in the same ring. #### The signals worth checking | Signal | What it looks like | The innocent explanation to rule out | | --- | --- | --- | | Age mismatch | An eight-year credit file, and an email address with no trace older than 18 months | A genuinely new email address, which people do change | | Shared attributes | The same address unit, phone, device or email pattern across applicants with different surnames | Families, flatmates and shared devices | | Borrowed history | A file whose age comes mainly from authorised-user accounts belonging to strangers | A parent adding a child as an authorised user, which is common and legitimate | | Throwaway infrastructure | Mail forwarding addresses, virtual offices, prepaid or internet phone numbers | Many real people use internet phone numbers | | An empty life | No public records beyond credit, no professional or social presence, nobody else ever mentions them | Privacy-conscious people, recent arrivals, the young | Every one of these signals has a common innocent cause, which is why the right-hand column is there. The useful question is whether several of them line up on one applicant. Shared attributes deserve particular attention, because they are the signal a synthetic ring cannot easily avoid. A ring running dozens of identities has a limited supply of addresses, phones and devices, and it reuses them. That reuse is invisible to anyone looking at one application at a time and obvious to anyone looking across all of them. #### A worked example The run below is a composite assembled from the pattern, not one real case. An application for an unsecured personal loan. The credit file is six years old, the score is respectable, and the history consists of two authorised-user accounts opened long ago on other people's cards and one card of the applicant's own, opened three years ago and paid on time every month. Every data-match check lines up. The research starts from what the application contains: the name, the email address, the phone number and the address. The email address appears in no public source older than fourteen months, and in no breach records at all. The phone number is an internet phone number. The address is a unit in an apartment building, and three other applications to the same lender in the last two quarters gave the same unit, under three different surnames. There is no professional profile and no social account older than a year. One thing does not fit. A university alumni list carries the same name with a graduation year that matches the stated date of birth. The name is fairly common, so it may be someone else entirely, or it may be the one genuine anchor in the file. The research cannot say which, and pretending otherwise would be guessing. So the output is an identity whose data checks out and whose life appears to begin about eighteen months ago, sharing an address with three other applicants, plus one open question. That is more than enough to route the application to step-up verification, and not enough to call it fraud. #### When to run the check At onboarding, because that is the cheapest point to stop a synthetic identity. But also at the moments a patient fraudster is waiting for: a large credit line increase, a new high-limit product, a sudden request for more after a long quiet period. A real customer's footprint keeps growing between those points. A synthetic identity's often does not, which gives a second look at month eighteen something to find that the first look at month zero could not. #### What defeats this An identity that was aged on purpose. Operations that open email accounts, social profiles and phone numbers years before they use them, and let those accounts sit, will produce a footprint that looks earned, because in a sense it was. Aged accounts are also bought and sold for exactly this reason. An identity that borrows a real person's life. The closer a synthetic identity sits to a real person's details, the more of that person's genuine footprint it can lean on. This approach raises the cost of a convincing synthetic identity. It does not make one impossible, and the identities that get through are the ones somebody spent real time and money on. #### Reading a thin file fairly Plenty of real people have thin files and thin footprints. Young adults. People who arrived in the country recently. People who have simply stayed out of credit. People who keep off the internet on purpose, including people who have left an abusive partner and removed every trace they could. The CFPB's [most recent estimate](https://files.consumerfinance.gov/f/documents/cfpb_update-credit-invisibles-estimate_2025-06.pdf), published in 2025 from December 2020 data, is that 2.7 percent of US adults, about 7 million people, have no credit record at all. That count leaves out everyone whose record is merely thin. A system that reads thinness as fraud declines exactly the people who most need a first credit product, for a reason none of them could do anything about. So treat thinness as a reason to verify further, not a reason to decline. The signals that point to fraud rather than to a quiet life are contradictions and sharing: traces that disagree about the identity's age, and attributes that turn up under other names. Absence on its own should only ever buy a closer look. #### How Sixtyfour runs it Sixtyfour's agent starts from what the application already contains, usually an email address, a phone number, a name and an address, and researches outward across breach records, public records, social and professional profiles, archived pages and other public sources. It weights each hit by how hard it would have been to manufacture, so a forum post from 2016 in a thread with other people replying counts for far more than a profile created last month. Every finding comes back with its source, and anything it could not establish is reported as open. It informs the step-up decision, and the credit decision stays with your team. There is more on how it fits a fintech or lender's review process on our [financial institutions page](https://www.sixtyfour.ai/solutions/financial-institutions). --- ### How to investigate an email address *An email address is often the only identifier a report arrives with. Here is what it can tell you, the order to read it in, and where it misleads.* Source: https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address Saarth Shah · 2026-09-22 · Trust & Safety To investigate an email address, work outward in four passes. Read the address itself, check the domain it sits on, establish how long it has existed, and then find the accounts attached to it. Weigh every finding by how hard it would have been to fake, and keep every step passive: nothing in a sound investigation touches the account or tells its owner that someone is looking. The rest of this piece goes through the passes in the order we run them, what each one is evidence of, and the mistakes that turn a good lead into a wrong answer. #### Why the email address is the place to start Trust and safety queues, fraud alerts and investigation referrals tend to arrive with very little attached. A reported seller comes with the email on the account, and a tip sometimes names an address and nothing else. Of the identifiers you are likely to be handed, the email address is usually the most useful to start from. People keep an address for years and use it to sign up for everything, so one address tends to sit underneath dozens of accounts its owner has forgotten about. It is also close to unique to one person. A username can be claimed by a stranger on any service where it happens to be free, and a phone number goes back into circulation when its owner lets it lapse. Google says a deleted Gmail address [can't be used by anyone in the future](https://support.google.com/mail/answer/61177). Not every provider works that way, which matters later. #### Pass one: read the address Before any lookup, the string itself carries information. The part before the @ often holds a name, a set of initials, a handle or a number. A two-digit number at the end is often a birth year or the year the address was made, and it is worth writing down as a hypothesis rather than a fact. A distinctive local part is a pivot: the same string as a username on other services is one of the first things to check. Normalise before you compare anything. Gmail [ignores dots](https://support.google.com/mail/answer/7436150) in the part before the @, and it [delivers mail sent to name+anything](https://support.google.com/mail/answer/12096) to the same inbox. So j.tarvelle84, jtarvelle84 and jtarvelle84+shop all reach one person. For a trust and safety team this cuts the other way too. An operator who opens ten accounts under ten spellings of one Gmail address looks like ten customers until someone normalises the column. #### Pass two: read the domain The domain sorts the address into one of three rough groups, and each needs different work. A large free provider says little on its own, because most people use one. A disposable or temporary-mail domain is a strong signal about intent at signup, because the address was made not to last. Community-maintained lists of these domains exist, and [one widely used list](https://github.com/disposable-email-domains/disposable-email-domains) on GitHub holds close to 9,000 of them. Treat a miss on a list as uninformative. New disposable domains appear faster than anyone can list them. A custom domain is where most of the information is. Look up its registration date through RDAP, which [ICANN made the definitive source](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en) for generic top-level domain registration data in January 2025, in place of WHOIS. Check whether it has mail records, whether it hosts a website, and whether that website agrees with what its owner has told you. An address on a domain registered three weeks ago, for a company that says it was founded in 2015, is a contradiction worth recording. Registrant details are usually redacted now, but the creation date almost always survives. #### Pass three: establish how old the address is Age is the most useful single thing to know about an address, and there is nowhere to look it up. It has to be inferred from the traces the address has left. Breach data is the strongest of those traces. If an address appears in the [2012 LinkedIn breach](https://haveibeenpwned.com/Breach/LinkedIn), it existed in 2012, whatever else turns out to be true about it. Date the address by when the breach happened, not when it surfaced: that one was stolen in 2012 and did not appear publicly until 2016. Have I Been Pwned lets you check an address against the breaches it indexes, and its [API](https://haveibeenpwned.com/API/v3) does the same for a single address with a paid key. Absence runs the other way, more weakly. Most addresses that have been in everyday use for years have turned up in at least one breach. So an address that is supposedly old and heavily used, with no breach history at all, is unusual. The same empty history is completely normal for an address that is genuinely new, or that belongs to someone careful. It is a question to hold open, not an answer. Other traces set a floor on age as well. The earliest archived page that mentions the address. The oldest public account that uses it. A Gravatar profile, which Gravatar [looks up by a SHA-256 hash](https://docs.gravatar.com/rest/hash/) of the trimmed, lowercased address, so an address can be checked without contacting anyone. And old public commits: Git records the author's email in every commit, and on a public repository [that metadata is public](https://docs.github.com/en/account-and-profile/how-tos/email-preferences/setting-your-commit-email-address) unless the developer has switched to a private noreply address. #### Pass four: find what is attached This is the pass that turns an address into a person, and it is where most wrong answers come from. Search for the exact address, in quotes, on general search engines. Search the local part as a username. Look for the address in the places people once posted it themselves: forum signatures, old classified listings, domain registrations from before redaction became standard, conference attendee lists, package registries and code. Every hit needs one question answered before it goes into a report: is this the same person, and how do I know? An exact match on the full address is strong. A matching username on another service is much weaker, especially when the handle is short or common. A matching name is weaker still. #### What each check is evidence of | Check | What a hit shows | What it cannot show | | --- | --- | --- | | Reading the local part | A name, handle or year worth testing | That any of them is true | | Domain type | Free, disposable or custom mail | Who controls the address | | Domain registration date | When the domain was created | When this address was created | | Breach records | The address existed by the breach date | That today's holder is the original one | | Gravatar and linked profiles | A profile someone attached to the address | That the profile's details are accurate | | Username reuse elsewhere | A lead worth following | That the other account is the same person | | Public code commits | A developer used the address in their work | Anything about identity beyond that | #### What not to do A few common techniques are best left out of a professional investigation. Do not use other services' signup or password reset forms to test whether an address is registered there. Answering those forms differently for known and unknown accounts is a recognised weakness, and [OWASP's guidance](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html) tells services to give the same response either way. Well-run services now do, so the results are unreliable. Some services also email the account holder about the attempt, which is the fastest way to tell a suspect that someone is looking, and the probing can breach the service's terms. Do not try to verify an address by talking to its mail server. The [SMTP standard](https://www.rfc-editor.org/rfc/rfc5321) lets servers switch off the command meant for checking an address, and in practice it is usually off. A server can also accept a recipient without deciding whether it exists, and a domain set up to take mail for any address will say yes to everything. Never use a password from a breach, not even to confirm a match. Logging in with someone else's credentials is access nobody authorised, whatever the reason for doing it. Passive methods also make better evidence. Something you found in a public record can be shown to a colleague, a customer or a court. Something you found by poking at a login form usually cannot. #### A worked example The case below is a composite built from a common pattern. The names and addresses in it are invented, and example.com stands in for a large free mail provider that, like Gmail, ignores dots. A marketplace's trust and safety team receives three buyer complaints about one seller in a week. The seller's phone number goes to voicemail, and the account has one email address: jonah.tarvelle84@example.com. The address first. A first name, a surname and 84. The surname is rare, which makes a username pivot worth more than usual. The domain says nothing by itself. Normalised, though, the address matches two other seller accounts on the same marketplace, both registered in the past month with the dots in different places. That moves the case from three complaints about one seller to three accounts behind one inbox. Age. The address appears in two breaches, the older from 2016. Whoever controls it now, it has existed for at least a decade. Attachments. The handle jtarvelle84 exists on a photography forum, with posts going back to 2015, from a city 200 miles from the seller's stated location. It also exists on a gaming site, created last year, with no activity. One of the old forum posts is a listing for a camera lens with the same email address written out in full. That leaves two stories sitting on one address. A real person with a ten-year-old inbox and a long, unremarkable forum history. And a cluster of new marketplace accounts using that inbox this month. The shape fits a compromised or bought account better than it fits someone defrauding buyers under their own name. It proves neither, and the report says so: three facts, one confirmed connection, and one open question about who holds the inbox today. #### Why this does not scale by hand Each pass is quick on its own. Run carefully, with every finding checked and sourced and the result written up, one address can easily take an experienced analyst the better part of an hour. That cost is the same whether the address turns out to matter or not, so busy teams ration it, and the rationing tends to fall on the cases that already looked suspicious. Sixtyfour's agent runs the four passes from the address alone, in parallel, and returns what it found with a source attached to every finding: where the address appears, how old each trace is, which attached accounts it believes belong to the same person and why. It weights each hit the way this piece does, by how hard it would have been to manufacture. A reviewer gets something they can check rather than a score they have to trust. There is more on how this fits an investigation team's workflow on our [investigations page](https://www.sixtyfour.ai/solutions/investigations). #### Reading the evidence carefully Addresses change hands. Yahoo [released dormant usernames for re-registration](https://www.cnn.com/2013/06/20/tech/web/yahoo-recycled-email) in 2013, and expired company domains put every address on them back up for grabs. A breach record from 2014 shows that the address existed then. It does not show that the person holding it now held it then. Shared inboxes are common. Couples and families share addresses, small businesses run everything through one, and a role address like info@ belongs to whoever is working that day. Common local parts mislead. A handle made of a first name and a number will match strangers on every large service. The rarer the string, the more a reuse match is worth. Quiet results mislead as well. People who guard their privacy, who have just moved countries or who rarely post anything will all look thin. When a search comes back quiet, try a different identifier before reading anything into it. #### The short version Read the address, then the domain, then its age, then what is attached to it, and keep every step passive. Weigh each finding by how hard it would have been to fake, and mark what you could not establish as open. Handled that way, one address becomes a short list of sourced facts that a reviewer can check. --- ### How to spot fake candidates before the interview *Interviews test whether someone can do the job. A constructed identity usually can.* Source: https://www.sixtyfour.ai/blog/how-to-spot-fake-candidates Julian Wong · 2026-09-18 · Trust & Safety Most advice about spotting fake candidates is advice about interviews. Ask harder questions, call the references, add a live coding round. That catches someone who inflated their experience. It does not catch a constructed identity, because the person on the call has been coached, the references answer the phone, and the portfolio contains real work. In July 2024 the security training company KnowBe4 hired a North Korean operative into a principal software engineer role. By [KnowBe4's own account](https://blog.knowbe4.com/how-a-north-korean-fake-it-worker-tried-to-infiltrate-us), the candidate used a valid US identity stolen from a real person and a photograph that was an AI-manipulated stock image, cleared a background check, and appeared on camera in four video interviews on four separate occasions. The company laptop was shipped to an address that turned out to be a laptop farm, and it began loading malware the day it arrived. KnowBe4's security team contained the machine about 25 minutes after the first alert, and says nothing was taken. That company sells security awareness training. Its hiring process was not careless. The point of the story is that every stage of a normal, competent process returned a pass. #### The operation behind it The people doing this are funded and organised, which is why they will spend months on one identity. The Justice Department's [June 2025 actions](https://www.justice.gov/opa/pr/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote) against North Korean IT worker schemes give a sense of the machinery. Searches of 29 known or suspected laptop farms across 16 states, carried out between October 2024 and June 2025, seized roughly 200 computers along with financial accounts and fraudulent websites. In one Massachusetts case, now [resolved by guilty pleas and sentencing](https://www.justice.gov/opa/pr/two-us-nationals-sentenced-facilitating-fraudulent-remote-information-technology-worker), the government says the defendants compromised the identities of more than 80 US citizens to obtain remote jobs at more than 100 US companies, costing those companies at least 3 million dollars in legal fees and remediation. A single facilitator gives the clearest picture of the scale. [Christina Chapman](https://www.justice.gov/opa/pr/arizona-woman-sentenced-17m-information-technology-worker-fraud-scheme-generated-revenue) ran a laptop farm out of her home in Arizona and was sentenced in July 2025 to 102 months for wire fraud conspiracy, aggravated identity theft and money laundering conspiracy. According to the Justice Department, that one operation used 68 stolen identities, defrauded 309 US businesses, and generated more than 17 million dollars. Investigators seized more than 90 laptops from her house, and she had shipped 49 more overseas, some to a city in China on the North Korean border. North Korea is the best documented version of this and it is not the only one. The same techniques serve proxy interviewing, one engineer quietly holding four jobs, and contractor fraud through staffing chains. What they share is that the identity is the product, and the identity is built to survive inspection. #### What this looks like from inside a security company Casco builds an agentic security engineer, software that probes your own code for what is exploitable in it. That makes Casco worth the setup cost, and their founder describes the result without much drama. Testimonial: casco | Rene Brandel | CEO and founder, Casco | We see fake North Korean workers apply to Casco. Sixtyfour flags adverse media and resume inaccuracies before we ever get on a call. He talks about it at more length in [our case study with Casco](https://www.sixtyfour.ai/#case-studies). The phrase worth sitting with is "before we ever get on a call." KnowBe4's process failed at four separate interviews. Screening that runs on the application never asks the interview to be the thing that catches it. #### Why the interview is the wrong place to look An interview tests whether someone can do the job, and a fabricated candidate is often a real engineer working under a false name, so they can. Every artifact the hiring process inspects is an artifact that was prepared for it. A background check has the same blind spot, and it is a more specific blind spot than it first appears. A background check confirms that a real identity exists and that nothing bad is attached to it. It does not confirm that the person in the interview is the one that identity belongs to. When the identity is stolen from a real US citizen with a clean record, a background check returns clean because the record is clean. It is answering a different question from the one you need answered. #### Why you cannot do this by hand An analyst can run the checks in the rest of this piece manually. It takes a few hours per candidate, and it costs the same few hours whether the answer turns out to be interesting or not. At real hiring volume that budget does not exist, so one of two things happens. The check gets skipped, or it gets run only on candidates who already looked wrong. The second is worse than it sounds. A prepared identity is built specifically to not look wrong, so screening on suspicion searches the population least likely to contain one. Filtering by stage is different from filtering by suspicion. Running the check on everyone who reaches a given stage is fine, because the stage is not correlated with the thing being hidden. Running it only on people who seemed off is much weaker, because that is the one filter the operation is built to pass. #### What a real person leaves behind Someone who has been online for a decade leaves a trail they never curated. Three questions on Stack Overflow from 2019. A comment on somebody else's bug report. An attendee list from a conference in a city they used to live in. An expired domain. A username that also appears on a forum about mechanical keyboards, tied to the same address as a Steam profile. None of that was created to prove anything, and that is what makes it expensive to reproduce. One convincing profile is cheap. Ten years of incidental presence, spread across services that do not talk to each other and that nobody thought to coordinate, is not. #### The four signals Thinness. Presence exists but has no age and no incidental edges. Every account was created inside a narrow window, and none of them connect to anything outside the professional story. Contradiction. The timeline does not survive cross-referencing. Two roles overlap by eight months. A degree comes from a university whose alumni records do not carry the name. A stated location disagrees with the timezone on the commits. Reuse. The same photograph, phone number, device fingerprint or payment detail appears under a different name somewhere else. Reuse has real innocent explanations, and they are common: people change names on marriage or transition, carriers recycle numbers constantly, and families share devices. What survives that is narrower and still useful, which is the same photograph presenting as two different people on two currently active professional profiles. Its value is that it is invisible to anyone looking at one application at a time, because it requires a corpus the candidate cannot see. Infrastructure. The residential address is a mail forwarder. The phone number is VOIP. The bank account was opened six weeks ago. The laptop's traffic terminates somewhere the CV never mentions. #### How the check runs Sixtyfour's agent starts from whatever the application already contains: an email address, a phone number, a code hosting handle, a name. It never takes the CV's account of the person as its starting point, so it cannot be steered by what the CV chooses to mention. It cross-references breach records, public records, social profiles, code hosting, forums and archived pages, and weights each hit by how hard that hit would have been to manufacture. An account opened last year counts for very little. A forum post from 2016, sitting in a thread with other people replying to it, counts for a lot. #### What that looks like on one candidate The run below is a composite assembled from the pattern, not one real case. A backend role. The candidate gives an email address, a CV listing four years across two companies, and an active GitHub. The agent runs the address. Inside a minute it has the GitHub, a LinkedIn created in the same month as the GitHub, one social account with nine followers, and nothing else. There are no breach records at all, which is unusual for an address a CV implies has been in use for eight years. The phone number sits in a VOIP range. Then the timeline. The CV puts four years at a company in one city. The commit timestamps cluster in a working day nine hours away from it. One thing does not resolve. There is a GitHub contribution history going back six years, which is older than everything else and does not fit the rest of the picture. It could be a purchased account, or it could be the one genuine thing in the application. The check cannot say which, and reporting it as suspicious would be guessing. So the output is three concrete inconsistencies and one open question. That is a list of things to ask about, and it arrives before anyone has spent an hour on a call. #### What defeats this An identity that was aged deliberately. Any operation prepared to open accounts two years before it uses them, post in real threads, and let the presence accumulate will produce a footprint that looks earned, because in the sense that matters it was. A purchased account with real history attached. A real person renting out their own past, which leaves genuine incidental presence and a genuine owner who will answer a reference call. This method raises the cost of a convincing identity. It does not close the door completely. The public cases are the operations that did not spend enough. #### Reading the signals fairly Plenty of real people have thin footprints. Someone who stays off social media. Someone who moved countries recently and left their earlier presence in another language and another alphabet. Someone who is twenty-two. A system tuned to read thinness as fraud turns all three away, and nobody hears why. The four signals above are deliberately limited to what a record can show. An accent, a non-US phone number or an unfamiliar name says nothing about whether an identity is genuine, and leaning on them only turns away real engineers. So thinness on its own only justifies looking closer. Contradiction and photo reuse are stronger, and both call for an explanation rather than a conclusion. The setup we recommend is a review queue: the check runs on every candidate who reaches a defined stage, and anything it flags goes to a person. The scoring is good enough to act on. A person sits at the end of it because the question is whether to offer someone a job, and somebody should look at that and decide. #### The short version Run the check on the application, for everyone who reaches the same stage. Treat what it finds as questions to ask, not answers. Then let the interview do what it is good at: finding out whether someone can do the job. --- ### Best Exa alternatives for AI agents in 2026 *Eight alternatives compared across search, live fetching, browser automation, and cost at volume.* Source: https://www.sixtyfour.ai/blog/best-exa-alternatives Hashim Khawaja · 2026-09-17 · Engineering Sixtyfour runs an investigative research agent. Every run starts the same way: find pages about a person, pull the content down, and carry on when a site refuses to cooperate. So we spend a lot of time thinking about the layer underneath, and we have opinions about who does what well. Exa is a good product. If you want semantic search over a prebuilt index and clean page text handed back in one call, it does that, and the API is pleasant to work with. Teams still leave it, usually for one of four reasons, and which reason you have decides which of the tools below you should look at. #### Why teams look past Exa The index is not the live web. Exa serves results from its own crawl, which is what makes it fast and what makes semantic search work at all. It also means a page published this morning, or a page Exa's crawler never reached, is not there. For a news query or a freshly updated profile, an index lookup and a live fetch give you different answers. Cost climbs with result depth. [Search is $7 per 1,000 requests](https://exa.ai/pricing), covering the first ten results, and every result past ten adds $1 per 1,000. Contents is billed per content type, so asking for text and highlights on one page counts as two. None of this is hidden, and it adds up in a way the sticker price does not suggest once an agent is calling in a loop. Some sites will not serve a crawler at all. News publishers are the obvious case. If the content you need sits behind an aggressive bot defence, an index that could not fetch it cannot hand it to you either. And nothing here logs in. Search and fetch are read-only by definition, so the moment your workflow needs to fill a form, click through a flow, or read something behind a session, you are outside what a retrieval API can do. #### How we picked these Our criterion is the whole chain: find the page, get the content, and where the job demands it, act on the site. We care about coverage of difficult domains, freshness, cost at volume, and whether there is a sane path from a prototype to production traffic. Prices were checked in September 2026. Several of them changed in the past year, so confirm before you budget. #### At a glance | Tool | Its actual job | Published price | Free tier | | --- | --- | --- | --- | | TinyFish | Search, fetch and Web Agent, live browser | Search and fetch $0; Agent $0.016/step; Browser $0.002/min | Yes, rate limited | | Brave Search API | Independent search index | $5 / 1k queries | $5/month credit | | Tavily | Search shaped for RAG | $0.008 / credit | 1,000 credits/month | | Firecrawl | Crawl a site into markdown | $16/month for 5,000 credits | 1,000 credits/month | | Serper | Cheap Google SERP data | About $0.30 to $1 / 1k | 2,500 queries once | | Jina Reader | URL to clean text | Free, then token billed | Yes, generous | | Parallel | Deep research with citations | Search $1 to $5 / 1k; Task $5 to $2,400 / 1k | 5,000 requests/month | | Browserbase | A real browser you drive | $20/month, then $0.12/browser hour | 1 browser hour | | Exa, for reference | Semantic index search | Search $7 / 1k; Contents $1 / 1k pages | $20 credit, $10/month | #### 1. TinyFish Image: exa-alternatives-tinyfish-homepage.jpg | TinyFish homepage | [tinyfish.ai](http://tinyfish.ai/) [TinyFish](https://www.tinyfish.ai/) sits first for us because it is the only tool on this list that covers the whole chain behind one key. Search, Fetch, Agent and Browser are separate endpoints on a single account, and the Agent will work through a multi-step flow on a site, including one that needs a login. The architectural difference from Exa is the one that matters. TinyFish fetches from the source with a real browser at request time, where Exa answers from its index. On a page that changed an hour ago, or a publisher that blocks crawlers, those two approaches do not produce the same result. On TinyFish's own [vendor comparison page](https://www.tinyfish.ai/compare/tinyfish-vs-exa), the company reports 49.2% top-result accuracy versus 38.4% for Exa, 93% fetch coverage versus 73%, and 15 of 15 news publishers reached versus 5 of 15. These are self-reported numbers from a TinyFish-run test set, not an independent benchmark, so treat them as directional rather than conclusive. For a third-party read, the [Artificial Analysis Search Index](https://artificialanalysis.ai/agents/search-api) (data as of Sep 8, 2026) puts TinyFish's search cost at $0 per 1,000 benchmark tasks, the lowest of the 13 providers tracked, including Exa. Search and Fetch are free, which is unusual enough to explain. The published free tier is 30 requests a minute and 500 an hour for Search, and 150 URLs a minute and 1,000 a day for Fetch. Agent runs cost $0.016 a step and Browser sessions $0.002 a minute, both funded from a prepaid wallet with a $10 minimum. Default concurrency is deliberately low, two Agent runs and five Browser sessions, and you raise it by talking to them. In July they released Mako, a web-native model that powers the Agent layer, trained on their own record of agents doing web tasks for customers. This is the one to reach for when your workflow does not stop at reading, or when the sites you need are the ones that fight back. The cost of that is operational. Anything at real volume starts with a conversation rather than a credit card, and the free search and fetch tiers are rate limited enough that you will feel them during a heavy backfill. #### 2. Brave Search API Image: exa-alternatives-brave-search-api-homepage.jpg | Brave Search API homepage | [brave.com/search/api](http://brave.com/search/api) [Brave](https://brave.com/search/api/) runs its own index, built from its own crawler, which puts it in the small group that does not resolve to Google or Bing underneath. Anyone who has watched a SERP reseller change behaviour overnight because their upstream changed knows what that independence is worth. Pricing is $5 per 1,000 queries with a $5 monthly credit, and the rate limit is 50 queries a second, high enough that most people never think about it. There is a separate Answers plan at $4 per 1,000 plus token costs. One clause to read carefully: storing results to train or fine-tune a model needs a plan that specifically grants those rights, and the standard terms do not cover it. If your pipeline retains raw results, settle this before you build on it. Brave suits anyone who wants a plain, fast, independent index with predictable per-query billing. It is search only, though. You get links and snippets, and the page content is your problem. #### 3. Tavily Image: exa-alternatives-tavily-homepage.jpg | Tavily homepage | [tavily.com](http://tavily.com/) [Tavily](https://tavily.com/) is built for retrieval-augmented generation and it shows in the shape of the API. You ask a question and get back results already trimmed to something you can put in a prompt. The free tier is 1,000 credits a month, pay as you go is $0.008 a credit, and a project plan adds higher rate limits. Credits are consumed at different rates by search, extract and crawl, and the pricing page sends you to the docs for the breakdown, which is mildly annoying when you are trying to model cost. It is a good choice when you are building a RAG pipeline and want the search layer to stop being a project. The abstraction that makes it quick to start is the same one you argue with later, when you need to know exactly which sources were consulted and why. #### 4. Firecrawl Image: exa-alternatives-firecrawl-homepage.jpg | Firecrawl homepage | [firecrawl.dev](http://firecrawl.dev/) [Firecrawl](https://www.firecrawl.dev/) turns a site into markdown. Point it at a URL, or at a whole domain, and get back clean text a model can read, with a crawler that handles the tedious parts. The free tier is 1,000 credits a month, Hobby is $16 a month for 5,000 credits, and it runs up to $599 a month for a million. A page scrape is one credit and search is two credits per ten results, while structured JSON extraction adds four credits a page, which is the line item that surprises people. Firecrawl fits when the job is a known set of sites whose content you want, rather than a search problem. Concurrency on the cheap plans is genuinely low, two concurrent requests on free and five on Hobby, so the first serious crawl you run will push you up a tier. #### 5. Serper Image: exa-alternatives-serper-homepage.jpg | Serper homepage | [serper.dev](http://serper.dev/) [Serper](https://serper.dev/) sells Google SERP data, fast and cheaply. It is the least ambitious tool here and that is the appeal. You get what Google returned, in a second or two, without any pretence of being more than that. Billing is prepaid credit packs rather than a subscription, running from roughly $1 per 1,000 queries at the entry pack down to about $0.30 at the largest, with 2,500 free queries to start. One credit covers ten results and going deeper costs two, so if your agent routinely asks for more than ten, budget at double the sticker. Take it when you want raw Google results and nothing else. You are buying links rather than content, and a reseller relationship with whatever sits upstream of them. #### 6. Jina Reader Image: exa-alternatives-jina-reader-product-page.jpg | Jina Reader product page | [jina.ai/reader](http://jina.ai/reader) [Jina Reader](https://jina.ai/reader/) is two endpoints. Put a URL behind [r.jina.ai](http://r.jina.ai/) and get clean text back. Put a query behind [s.jina.ai](http://s.jina.ai/) and get the top results as text. It handles PDFs and will caption images. It works with no API key at all at 20 requests a minute, a free key raises that to 500, and new keys come with 10 million tokens. Billing past that is by output tokens, and search requests carry a fixed 10,000 token minimum whatever comes back. This is the cheapest way we know to turn a URL into something a model can read, and a sensible fallback partway down a chain. It makes no attempt to solve hard fetches, so the sites that block bots will block this too. #### 7. Parallel Image: exa-alternatives-parallel-homepage.jpg | Parallel homepage | [parallel.ai](http://parallel.ai/) [Parallel](https://parallel.ai/) aims at multi-step research that returns citations, which puts it between a search API and an agent. The Task API runs processors at increasing depth, from Lite at $5 per 1,000 requests up to Ultra8x at $2,400 per 1,000 for runs that take eight to thirty minutes. A plainer Search API sits underneath at $1 to $5 per 1,000, with a Turbo processor around 200ms, and there are 5,000 free requests a month. We know Parallel from a second angle, since it appears in [our own people-research benchmark](https://www.sixtyfour.ai/recon-benchmark), where Parallel Ultra 2x scores 41.1% weighted accuracy against Sixtyfour High at 54.3%. That benchmark is ours and it measures people research specifically, so read it as one narrow result rather than a verdict on the product. Parallel earns its place when the unit of work is a research question rather than a query and you need the citations to defend the answer. The deep processors cost enough that you have to be deliberate about which requests deserve one. #### 8. Browserbase Image: exa-alternatives-browserbase-homepage.jpg | Browserbase homepage | [browserbase.com](http://browserbase.com/) [Browserbase](https://www.browserbase.com/) gives you a real browser in the cloud that you drive yourself, with Playwright or Puppeteer or an agent framework on top. It is a different layer from everything above, with no opinion about search, just a browser that someone else keeps alive. The Developer plan is $20 a month with 25 concurrent browsers and 100 browser hours, then $0.12 an hour. Startup is $99 for 100 concurrent and 500 hours. There are Search and Fetch endpoints too, at $7 and $1 per 1,000, which lands in the same place as Exa. Reach for it when you have logic that genuinely needs a browser and would rather not run the fleet yourself. You are writing and maintaining the automation, which is both the point of the thing and its real price. #### What actually breaks at volume Three things, none of which show up while you are prototyping. Concurrency ceilings arrive before price does. Most of these publish a per-minute or per-second limit that is fine for development and too low for a backfill, and raising it is a conversation with a salesperson rather than a settings page. Find your ceiling early, because discovering it during a production run makes for a bad afternoon. Per-result billing changes the shape of your cost. Exa, Serper, Firecrawl and Parallel all price the first ten results differently from the next ninety. An agent that asks for more results when it is uncertain will quietly double its own bill, and you will find that in the invoice rather than in the logs. Coverage is bimodal. A fetch layer does not degrade gracefully across hard sites, it works or it does not, and the sites it fails on are the same ones every time. Test against the twenty domains you actually care about rather than a random sample, because the average tells you very little about your case. #### Frequently asked questions ##### What is the best Exa alternative? It depends which part of Exa you were using. For live fetching, and for anything that needs to act on a site, TinyFish. For plain independent search, Brave. For turning known sites into text, Firecrawl or Jina Reader. For research questions with citations, Parallel. ##### Is Exa expensive? At $7 per 1,000 searches it sits at the higher end for search, and the per-result and per-content-type billing means the effective rate usually lands above the sticker. Whether that is expensive depends on whether the semantic index is doing work for you that a cheaper keyword index would not. ##### What is the difference between a search API and a scraping API? A search API answers "which pages are about this" and gives you links. A scraping or fetch API answers "what does this page say" and gives you content. Exa does both in one call, which is convenient and is also why its billing has two dimensions. Most of the tools here do one of the two well. ##### Can any of these read pages behind a login? Only TinyFish and Browserbase, and they get there differently. TinyFish's Agent handles authenticated multi-step flows as a managed service. Browserbase gives you a browser and you write the flow yourself. Everything else on this list is read-only. ##### Do I need an index or live fetching? An index is faster and cheaper per call and gives you semantic search across pages already crawled. Live fetching is slower and reaches pages an index missed or was blocked from. If freshness or hard domains matter, you want live fetching, possibly with an index in front of it for the easy cases. ##### What if the thing I need from Exa is research on people? None of the tools above solve that on their own. Searching a name returns pages containing that name, which is a weaker claim than establishing that they all describe the same person, and that gap is where most people-research pipelines quietly go wrong. If the job is identity resolution or background research rather than retrieval, you want something built for it. We publish [RECON](https://www.sixtyfour.ai/recon-benchmark), a benchmark for how well agents find long-tail facts about a specific person, which covers the systems that compete on that directly. ##### How do I check whether a result is current? Ask the vendor when the page was fetched, not when it was published. An index will happily return a page it crawled months ago, and the publication date printed on that page tells you nothing about the gap. Tools that fetch at request time do not have this problem. #### What we build Sixtyfour is a people research API. You hand it an identifier, a name, an email address, a company, a profile URL, and it works outward from there across fragmented sources and returns the specific facts you asked for, with provenance attached. Most of the teams using it work in trust and safety, investigations or identity verification. It sits on top of infrastructure like the tools above rather than replacing any of them, which is why we spend so much time comparing them. If that is your problem too, the [RECON benchmark](https://www.sixtyfour.ai/recon-benchmark) is the most useful thing we publish, and there is a [demo](https://www.sixtyfour.ai/demo) if you would rather see it run. --- ### Inside Sixtyfour: how we operate *Twelve principles we actually run on — plus the 120lb flat cart that explains all of them.* Source: https://www.sixtyfour.ai/blog/how-we-operate Justin Young · 2026-09-11 · Company #### General operating principle > 💡 When a customer asks for a watergun, we hand them a bazooka. That's the saying in our office, and it's the closest thing we have to a mission statement for how we work. A customer never asks for the thing they actually need. They ask for the smallest thing they think they can get away with asking for. A CSV. A quick check. "Can you just look at one profile for me." Most companies hand over the watergun. Exactly what was asked, nothing more, ticket closed. We hand over the bazooka. We look at what they're actually trying to do, and we solve that, at a scale and depth they didn't think to ask for. Then they tell their friends. #### The wagon and the flat cart When we moved offices, Saarth needed a little 1-foot wagon to move some boxes. Reasonable ask. Ronin, our Head of Growth, showed up with a 120lb flat cart which he got from his apartment complex 2 miles away. I still don't know how he brought that over to this day. Image: how-we-operate-wagon.jpg | A small folding utility wagon | The 1-foot wagon. The literal ask. Image: how-we-operate-flat-cart.jpg | Two people loading parcels onto a 120lb orange flat cart in the Sixtyfour office | The flat cart. What was actually needed. That's the whole culture in one picture. Nobody told Ronin to do that. He heard "I need to move stuff," skipped the literal request, and solved the actual problem so hard it became a joke. That's high agency. It's the trait we care about more than any other, and every principle below is a version of it. #### How we operate ##### 1st Principle: Our goal is our customers. Everything at Sixtyfour exists to make our customers successful. Not to raise money, not to look cool on X, not to have the smartest agent architecture. Those things are nice. They are not the point. In practice: - When a customer needs something on a Saturday, it gets done on Saturday. Not because there's a policy. Because they need to feel seen, and a customer who feels seen doesn't churn. - When a customer says "this report was insane," it makes the whole team's week. When one churns, it stings for a while. - We would rather over-deliver to 10 customers than under-deliver to 50. We don't enforce this. You can't enforce caring. We hire people who already care and then we get out of their way. ##### 2nd Principle: Bazookas, not waterguns. High agency means you own the outcome, not the task. - You don't wait to be told. You see the gap and you fill it. - You don't do exactly what was asked if you can see the person actually needs something bigger. - You don't say "that's not my job." At a company this size, every job is your job. - You don't stop at the first "no" from a tool, a vendor, or a process. You find another way. The 1-foot wagon is the literal ask. The flat cart is what they actually need. Bring the flat cart. ##### 3rd Principle: We move insanely fast. Fast gets good before good gets fast. - Ship the thing. Get feedback. Fix it. Ship again. A rough answer to a customer in 20 minutes beats a perfect one tomorrow. - Speed is a customer feature. Half of why customers love us is that we respond like we're sitting next to them. - In a fast-moving environment, the cost of waiting is almost always higher than the cost of being wrong and correcting. ##### 4th Principle: Happy customers → happy team → better company. This is the ops flywheel, and it only spins in one direction. Customers happy → they renew, they expand, they tell people. That's revenue and pipeline we didn't have to buy. Team happy → we ship more code, write better content, and work in sync instead of stepping on each other. Morale isn't soft. It shows up in the commit log. Ops sits in the middle of this loop. Half the job is making sure customers feel seen. The other half is making sure the team is fed, unblocked, and not drowning in admin so they can do the work that makes customers happy. Same job, two ends. ##### 5th Principle: We prioritize ruthlessly. You will always have more asks than hours. Every ask gets sorted on two axes: who it's for and how time-sensitive it is. | | Urgent (today / this hour) | Soon (this week) | Whenever (no deadline) | | --- | --- | --- | --- | | Customers | 🔴 Drop everything. Weekends included. | 🟠 Do it today anyway. | 🟡 Batch it, but don't let it sit past the week. | | Prospects | 🟠 Same day. A slow reply is a lost deal. | 🟡 Within 48 hours. | 🟢 When there's a lull. | | Team | 🟠 Unblock them now if it's blocking a customer; otherwise same day. | 🟡 This week. | 🟢 Backlog. | | Investors | 🟡 Same day, but after customers. | 🟢 This week. | ⚪ When it's convenient. | How to read it: - Customers outrank everyone. A customer "whenever" still beats an investor "soon." - Prospects are close behind. A prospect is just a customer we haven't closed yet. - Team asks feel the most urgent because they're the loudest and closest to you. Resist that. Sort them honestly. - Investors matter, but investors are patient. Customers are not. - If two things land in the same cell, the one closer to revenue wins. ##### 6th Principle: Precision with the team. Humanity with customers. Two different modes of communication. Don't mix them up. With teammates: precise and detailed. In a high-stakes, fast-moving environment, vague messages cause fuckups. Minor fuckups incur major losses. Say exactly what, exactly who, exactly by when, and exactly what "done" looks like. Over-communicate context. A message that takes you 30 extra seconds to write can save someone an hour of guessing. With customers: sound like a human. Don't use AI when chatting with customers, or at the very least don't sound like it. There is so much slop out there right now that a real human message with a typo, a "lol," an actual opinion hits completely different. Customers can smell a template. Write like you're texting a friend who happens to pay us. ##### 7th Principle: Ask. Then ask again. Most of my biggest fuckups came from one thing: I didn't ask enough clarifying questions. To a teammate, to a customer, to the CEO. I assumed, I ran, and I built the wrong thing fast. - Ask before you start. "When you say X, do you mean A or B?" costs 30 seconds. Rebuilding costs a day. - Don't be afraid of looking dumb. Nobody remembers the dumb question. Everybody remembers the wrong deliverable. - But be tasteful. There is a point where a dumb question is just a dumb question. If the answer is in Slack, the docs, or the last five minutes of the call, go find it first. - Ask for help before you drown. I once took on too many time-sensitive requests from too many teammates at once, and delivered mediocre work on all of them. Nobody wins in that scenario. If you are sure you can't do something well and on time, say so early. We're a team. Someone will grab it. ##### 8th Principle: Be a sponge. Collect as much context as you possibly can, as fast as you can. Sit in on sales calls. Read every customer thread. Understand the sales cycle end to end: who the buyer is, what they're evaluating, what makes them sign, what makes them stall. Understand the team dynamic: who owns what, who's stretched, who needs what from you. The more context you have, the fewer clarifying questions you need, and the better your instinct gets for when a watergun ask is actually a bazooka ask. ##### 9th Principle: Low ego. Get your hands dirty. No task is below you. Not one. The same person who runs a customer call at 10am is hauling boxes at noon, ordering lunch at 11:30, and cleaning up the kitchen at 6. The Head of Growth dragged a flat cart 2 miles. The CEO takes out the trash. Nobody here thinks their title exempts them from the unglamorous stuff, because the unglamorous stuff is what keeps the company running. - If something needs doing and you're the closest person to it, it's yours. - You can't be afraid to get your hands dirty. Wiping down tables, chasing an invoice, packing boxes, fixing a broken CSV by hand at midnight. All of it counts. - Ego slows everything down. The moment someone decides a task is "not their level," the task sits there and the whole team eats the delay. - Low ego also means taking feedback without flinching. If you're wrong, say so, fix it, move on. The people who go furthest here are the ones who never once asked whether a job was worth their time. They just did it. ##### 10th Principle: We love the untravelled path. Conventions are fine when they work. But that's all they are. Conventions. Look at who's actually on this team. One of our founding engineers dropped out of school to join us when he was 19. Some of us came from research labs. Some of us came from door-to-door sales. Some of us came from making content. A huge chunk of the team are international students who moved across the world to build here. That's not an accident. We hire for unique perspectives, because the obvious path has already been walked by everyone else, and there's nothing left on it. The interesting stuff is off the trail. - If a customer request sounds weird, that's a reason to lean in, not a reason to say no. - If nobody on the team has done something before, great. That means we get to figure it out. - If the "normal" way of doing something is slow or boring, find the abnormal way. A room full of people who took the same path will all see the same things. We'd rather see something new. ##### 11th Principle: We always want more. Nobody here is waiting to be handed a bigger challenge. They go and take one. The pattern at Sixtyfour is that someone finishes what they were hired to do, then shows up asking for the next, harder thing. The ops person starts running sales calls. The engineer starts writing content. The intern starts closing deals. We love this. It's how a small team punches way above its headcount. - Master your lane, then step out of it. - If you're bored, that's a signal to ask for more, not to coast. - The people who grow fastest here are the ones who never think of their job description as a ceiling. - Be an infinite learner. There is always more to want. ##### 12th Principle: We are extremely capital efficient. We don't throw money at problems. We think first. We are a small team with a finite runway, and every dollar and every hour is a bet. A lazy team spends its way out of problems. A strategic team asks whether the problem even needs money, and if it does, what the smallest amount is that gets the answer. This doesn't mean we're cheap. It means we're deliberate. We spend on things that move customers, and we don't spend on things that don't. - Think before you spend. Can this be solved with a message, a workaround, a favor, or an afternoon of work instead of a purchase? Usually yes. Ronin didn't buy a cart. He borrowed one. - Minimum viable tests. Before committing a week, commit an afternoon. Before a big enrichment, run a sample. Before a big event, run a small dinner. - Say no to bad-fit customers. A customer who isn't a fit today costs more to serve than they pay. It's fine to turn them away or park them. - Neglect on purpose. It's normal for parts of the product, the office, or the process to be ugly because we're focused on something that matters more right now. That's a choice, not an oversight. - Go all-in when it counts. Sometimes a thing looks trivial from outside but is the whole deal. When it is, we throw everything at it, money included. Extreme prioritization, minimum viable tests, and thinking before spending. That's how a small company acts like a much bigger one. --- ### Reverse username search: tracing one handle across platforms *Bad actors hide behind pixelated avatars and disposable handles. Here is how the chain unravels.* Source: https://www.sixtyfour.ai/blog/how-we-use-agents-for-reverse-username-search-investigations Hashim Khawaja · 2026-05-16 · Trust & Safety #### Field Brief - Scams starting on social media accounted for the highest total losses at $1.4 billion in 2023. - Trust and safety teams rely on IP bans or device fingerprinting, but operators rotate hardware and VPNs. - Our agents can automate a reverse username search, tracking handle reuse across forgotten forums, dormant Discord servers, and old data to surface real names, locations, and emails in minutes. #### The Anatomy of a Reverse Username Search On platforms like Roblox, which has 78 million daily active users, more than 40 percent of the user base consists of preteens. Because of strict compliance rules, gaming platforms cannot ask children for their real name, email, or phone number at signup. Every user is an anonymous username and a pixelated avatar. Since 2018, only 24 people have been arrested for abusing children they met on that specific platform. The reason predators evade capture is simple. Trust and safety teams ban the IP address. The operator boots up a residential proxy. The platform bans the account. The operator registers a new one. But a username is rarely single-use. The internet is sticky. An operator spinning up a burner account on a gaming platform in 2024 shares behavioral DNA with an account they created on a defunct forum in 2018. They reuse passwords. They leak their own aliases. This behavior scales across organized fraud rings. Account takeover attacks jumped 354% year-over-year in Q2 2023 across Sift's global network. A manual reverse username search relies on an analyst plugging that handle into search engines, deep web databases, and known operator registries. The analyst hopes for a match. It works, but it takes days or weeks of cross-referencing. By the time the analyst links a gaming handle to a known fraud ring, the operator has already extracted the funds or moved to a new target. #### Resolving the Alias to a Real Jurisdiction Finding a real name is only the first phase. The final step of a reverse username search is resolving that identity to a physical jurisdiction and mapping the associated corporate entities. This is highly relevant in marketplace fraud and intellectual property theft. In 2022, federal authorities cracked a massive counterfeit hardware ring. Onur Aksoy, who used the alias “Dave Durden,” ran a massive scheme trafficking over $1 billion in counterfeit Cisco gear through at least 19 companies and dozens of online storefronts. Tracing an alias like “Dave Durden” manually through Amazon seller pages and eBay profiles yields fragmented data. The operator registers storefronts under synthetic identities. > Check out social media, Telegram and everywhere else. The proliferation of advertisements that lure consumers into this rabbit hole of fraud is just getting started. Buckle up. — Frank McKenna, Chief Fraud Strategist, Point Predictive Our agents follow that trail to surface a real name, location, email, and full digital profile from a handle alone. They automate the exact methodology a forensic accountant or federal investigator uses, executing the queries in parallel across thousands of disparate data sources. Instead of a trust and safety team waiting 31 days for a subpoena response to identify a seller, they see the operator's real name and associated shell companies the moment the account flags for suspicious volume. They identify the operator before the funds leave the platform. If our agents can find a predator hiding behind a Roblox username, imagine what the graph can do when you need to research a syndicate targeting your onboarding flow. Full integration docs at [docs.sixtyfour.ai](http://docs.sixtyfour.ai/). --- ### Identity resolution: catching banned users who rotate hardware *Device fingerprinting works on the bottom 90% of operators, but the top 10% rotate hardware before breakfast. Here is how to stop them.* Source: https://www.sixtyfour.ai/blog/how-we-use-agents-for-identity-resolution-on-banned-scammers Saarth Shah · 2026-05-12 · Trust & Safety #### Field Brief - Sift recorded a 354% year-over-year increase in account takeover attacks, driven largely by operators bypassing traditional device fingerprints. - Most trust and safety teams respond by banning the account, but banned scammers return within hours using clean IPs and fresh emails, creating the empty footprint anomaly. - In theory, this can be solved by tracing a single banned username back through old forums, social accounts, and breach data to find the real person. - Our agents do exactly that, cross referencing clear web public records, underground marketplaces, and proprietary databases to map the human behind the keyboard. #### The Account Takeover and Ban Evasion Loop Sift recorded a 354% year-over-year increase in account takeover attacks in Q2 2023. Trust and safety teams ban these compromised accounts daily. The operators simply return the next morning with a clean IP and fresh email address. This creates the empty footprint anomaly. We define this as a signup method with zero historical presence across breaches, social platforms, or public records. A real person has years of digital depth tied to their primary email. They ordered food, bought shoes, and registered for forums. A returning bad actor has an account created 12 hours ago. > What's driving a majority of the fraud risk in the last 12 to 18 months has been the sharing of schemes like credit washing and stolen social security numbers on social media. — Frank McKenna, Chief Fraud Strategist at Point Predictive If a platform relies purely on session telemetry, the attacker already has the playbook to bypass it. #### How to Map Cross Platform Fraud Rings The FBI's Internet Crime Complaint Center reported $12.5 billion in losses across 880,418 complaints in 2023. A massive portion of that volume flows through repeat offenders using burner identities. Real investigations prove that isolated bans do not disrupt these networks. Identity resolution proves exactly how these networks unravel. #### Tracing the Reused Username A marketplace customer banned a top scammer. Twelve hours later, a new applicant appeared. The only mistake the operator made was reusing the same username across niche forums even when he rotated primary emails. The banned username appeared on seven different platforms. One of those matches traced back to a 2016 gaming forum. The operator had posted there using his real first name. That single post connected to a Reddit account listing his home city. The Reddit account led directly to an email exposed in a 2021 breach data dump. That breach record contained his full legal name. The operator thought he was anonymous. He was actually leaving a traceable map. #### How Identity Resolution Works We do not rely on session telemetry or IP geofencing to map these networks. We built an investigative layer that cross references fragmented signals across the internet. ##### The Input Layer Investigators input a single identifier into the platform. This can be an email, a phone number, a Telegram handle, a cryptocurrency wallet, or a marketplace seller ID. Our agents query multiple surfaces in parallel. The system searches Sixtyfour proprietary identity databases, dark web underground mentions, and historical breach records detailing password reuse. It maps social profiles across platforms like LinkedIn, GitHub, Reddit, Steam, and Discord. It pulls clear web public records, including LLC registries, court filings, and marketplace seller pages. ##### Resolving the Graph LLM reasoning weighs the quality of these signals. A phone number surfacing in a 2023 breach record tied to an email represents a high confidence link. That same email appearing in two account rental Telegram groups forms another edge. The output is a clear graph. It shows the connected accounts, the confidence scores for each edge, and the exact platforms the operator uses. #### What This Means for Trust and Safety Stacks Trust and safety teams must adapt their entry gates. Device fingerprinting catches the operator who reuses one phone. It does not catch the operator who buys a $30 burner SIM for each new account. Teams should monitor for the empty footprint anomaly first. It catches the highest confidence synthetic accounts immediately at onboarding. An email with zero history on GitHub, Reddit, or historical breaches is rarely a high value customer. In 2023, FinCEN issued advisories explicitly noting that state sponsored actors, including the Lazarus Group, exploit weak onboarding checks to launder funds. Stopping these actors requires looking past the device. Second, teams must implement identity resolution on banned operators to understand the blast radius. If you do not map the entire network, banning one account just forces the operator to switch tabs. The goal is removing the human behind the keyboard, not just burning their current alias. --- ### How to detect rented gig-worker accounts *A $65 Facebook transaction is all it takes to put an unvetted stranger behind the wheel. Here's how Sixtyfour closes that gap.* Source: https://www.sixtyfour.ai/blog/how-we-use-agents-to-detect-rented-gig-worker-accounts Hashim Khawaja · 2026-05-08 · Trust & Safety The app said a woman was delivering her food. A man showed up. He had paid $65 for that account on a Facebook group. This is what a verification gap looks like in the real world. #### The Problem - The February 2025 Wilbraham, MA Uber Eats assault was committed by a man using a rented account registered to a woman. - 1 in 4 gig workers has rented or sold their verified account; this rises to nearly 1 in 3 for Millennial and Gen Z drivers. - Standard KYC and background checks at signup miss this completely. The problem is a failure of continuous identity verification, not onboarding. #### The Gig Economy's Continuous Identity Problem Every major gig platform runs background checks. The accounts are legitimate. The people who passed are real. The issue is what happens after verification. These accounts are openly traded in private Facebook groups and Telegram channels for anywhere from $65 to over $400 a month. The platform recognizes a valid account ID, but the trust-and-safety team is unaware of the transaction that put an unvetted person behind the wheel. #### How We Trace the Real Person ##### The Input: A Flagged Account An investigation starts with a driver account for "Sarah L." Flagged for a sudden spike in negative reviews and trips running 18 hours a day. The only hard data point: her phone number. ##### The First Trace: Anchoring the Real Owner Our agent cross-references the phone number against our identity graph, breach data, and public social profiles. Within seconds: LinkedIn, GitHub, forum usernames, and two breach records — all linking back to the same person. ##### The Second Trace: Surfacing the Renter The device ID logging trips is an Android model Sarah has never used. Trip origins are 60 miles from her address. Active hours don't align with her social posts. Our agent finds the renter on a dark web forum using a password fragment from one of Sarah's old breaches. #### How Identity Resolution Differs From Standard KYC Traditional KYC answers one question: is this person who they say they are right now? Our agents answer a different one: who is this person, everywhere? 1. The Input — A single flagged identifier: email, phone, username, crypto wallet, or name. 2. The Search — Cross-referenced across Sixtyfour's proprietary databases, dark web sources, breach records, social profiles, and public records. 3. The Resolution — An LLM-driven inference layer weighs signal quality and maps resolved entities into a unified graph. 4. The Output — A graph of connected accounts with confidence scores. Not a single data point — a complete picture. 5. What We Don't Do — No IP-based ID, no device fingerprinting, no private platform data, no legal determinations. --- ### Beneficial ownership: tracing who is behind a shell company *In 2024, TD Bank pleaded guilty to $18.3 trillion in unmonitored transaction activity tied to money laundering. Here is how agents trace the beneficial owners behind shell networks.* Source: https://www.sixtyfour.ai/blog/how-we-trace-hidden-beneficial-owners-behind-shell-companies Roham Mehrabi · 2026-05-05 · Trust & Safety In 2024, TD Bank pleaded guilty to $18.3 trillion in unmonitored transaction activity tied to money laundering, and here is how to trace the beneficial owners behind the shell networks using agents. #### Field Brief - FinCEN reported the United States loses approximately $70 billion annually to shell company exploitation, masking illicit funds behind layered LLCs and nominee directors. - Most compliance teams pull the corporate registration, find a law firm address or nominee name, and hit a dead end when the real owner does not appear on the paper. - Stopping the flow requires tracing the digital footprint of the formation email, the shared registered agent, and cross-platform public records to find the human controller. - We use our agents to cross reference entity names against breach data, court filings, and public registries to map the hidden human network in minutes. #### The AML Compliance Gap in Shell Company Detection In 2024, the United States Department of Justice forced TD Bank to plead guilty to Bank Secrecy Act violations. The institution failed to monitor $18.3 trillion in transaction activity over six years. Much of this unmonitored flow moved through layered corporate entities designed specifically to obscure the beneficial owner. We call the primary evasion tactic the shell-LLC chain. We define this as multiple LLCs registered to the same agent address, identifying coordinated networks rather than isolated businesses. A second pattern is nominee shielding, where an operator uses a localized registered attorney to sign formation documents while the controller remains completely off the record. > The current patchwork of AML/CFT requirements creates regulatory gaps that criminals and foreign adversaries exploit to launder money, hide illicit wealth, and compromise American innovation. — Andrea Gacki, Director at FinCEN #### How to Map Beneficial Owners in AML Investigations Consider the DOJ findings in the Onur Aksoy counterfeit ring. The operator controlled at least 15 different shell entities. Each entity shielded a portion of the fraudulent Cisco network from direct attribution. When investigators shut down one LLC, another absorbed the volume immediately. The human operator never used his real name on the initial Amazon seller applications. Instead, investigators found an email address tied to a formation document. That email had surfaced in a 2018 data breach. Cross referencing the compromised email pulled up a specific burner phone number. That same phone number appeared on a completely separate domain registration two years prior. The domain registration included a physical address. That physical address matched the registered agent for four additional LLCs operating in the exact same marketplace. The network collapses when you map the human history behind the entity. A shell company is an abstract legal wrapper, but a human operator leaves a permanent digital footprint. #### Finding the Real Person Behind a Shell LLC in 2026 Here is how our agents resolve the network. The input is a single piece of evidence. Investigators can often start with just an entity name, a formation email, a phone number, or a law firm address. ##### The Search Surfaces We query Sixtyfour proprietary identity databases, dark web sources, and underground marketplace mentions in parallel. We check breach records for compromised emails, phones, and password reuse. We scan social profiles across LinkedIn, GitHub, Reddit, and Telegram memberships. We pull clear web public records including LLC registries, court filings, and news mentions. ##### Resolving the Graph A flagged phone number surfaces in a 2023 breach record tied to an email. The same email is the registered owner of two other corporate entities under different names. The output returns a mapped visual of connected accounts, confidence scores per edge, and the exact surfaced identifiers linking them. #### The Future of AML Tools and Corporate Entity Structures As FinCEN rolls out stricter beneficial ownership reporting, operators will rely even more heavily on synthetic identities and dark web nominee rentals. The institutions that survive the next decade of enforcement will not be the ones that collect the most corporate formation documents. They will be the ones that can accurately trace the single human operator hiding behind the paper. --- ### Case study: how Mercor finds AI training experts *How Sixtyfour helps Mercor find rare experts who can generate training problems current AI models cannot solve.* Source: https://www.sixtyfour.ai/blog/case-study-how-mercor-uses-sixtyfour-to-find-ai-training-experts Christopher Price · 2026-02-11 · Company #### Case Study: Mercor + Sixtyfour #### The Problem To train GPT-5, OpenAI needed GPT-4 to be wrong. This is how model improvement works: you need examples where the current model fails but a human expert succeeds. These failure cases become the training data that teaches the next model what it doesn't know. But GPT-4 is already good enough that most people can't consistently generate questions it cannot answer. When an AI lab needs these rare failure cases in dermatology, investment banking, or competitive programming, they turn to Mercor. Mercor has to find the small number of people whose expertise exceeds what the models have learned from the internet's corpus. #### What Mercor Does with Sixtyfour Before Sixtyfour, Mercor's sourcing process could take weeks per search, often returning candidates who looked qualified on paper but couldn't actually stump the models. Sixtyfour changed this. Sixtyfour's platform starts with targeted data sources. For dermatologists who might know of rare conditions that current state of the art models don't, Sixtyfour pulls from medical association directories. For algorithmic problem experts, Sixtyfour examines competitive programming leaderboards. For complex financial structures the model might not grasp, Sixtyfour identifies people who went from collegiate consulting clubs to senior positions at investment banks. A name from these sources means nothing by itself. So Sixtyfour's enrichment agents recursively explore everything they can find. They start with an initial data point, read through every linked page, conduct additional searches based on what they discover, then read through those results, continuously branching out. From a single name and affiliation, the agents might traverse academic publications, find co-authors, explore their work, discover conference presentations, identify specialized forums they participate in, and build a complete picture of expertise that no single source contains. This recursive scraping methodology means that even when requirements become extremely narrow, say the labs need not just a dermatologist, but one specializing in rare genetic skin conditions affecting fewer than a thousand people worldwide, Sixtyfour can still deliver. The agents keep searching, reading, and connecting dots until they find the three people on Earth who fit the criteria. Mercor now creates qualified candidate lists in hours rather than weeks. More importantly, these candidates actually possess the capability Mercor needs: they can consistently generate problems the AI cannot solve. #### Results The process works. Mercor successfully delivers experts to AI labs who can generate questions and problems that current state of the art models cannot solve. These become part of the training regime for the next generation of models. For Mercor, this has made an extremely difficult sourcing challenge both manageable and fast. The foundational model companies need these experts to push their models forward. Without them, the models plateau. Mercor can reliably deliver these experts because Sixtyfour's recursive methodology can identify and qualify the right kind of expertise from millions of potential candidates, regardless of how specific the search parameters become. As models improve, fewer humans will be able to provide useful training signals. The pool shrinks with each generation. But Sixtyfour's approach ensures that as long as such experts exist, Mercor will find them. --- ### Case study: how Conduit unlocked the STR market *How Sixtyfour helped Conduit identify fragmented short-term rental management companies that traditional data vendors could not reach.* Source: https://www.sixtyfour.ai/blog/case-study-how-conduit-unlocked-the-str-market-with-sixtyfour Saarth Shah · 2026-02-11 · Company Conduit, formerly HostAI, builds AI agents for real estate—specifically for short-term and long-term rental management companies. If you run dozens of listings across Airbnb, Vrbo, [Booking.com](http://booking.com/), or Tripadvisor, and you use a property management system like Guesty, HostAway, or RentManager, Conduit can automate your entire operations stack. But there was one major problem: Conduit's market is big but very fragmented and hard to reach. #### The Discovery Problem Many STR management companies operate behind listing platforms that actively block backlinks to company landing pages. Most of these companies aren't big or well-known, and they’re distributed globally. Traditional data vendors like Apollo, ZoomInfo, BuiltWith, and Clay couldn’t help. After trying all of them, Conduit was left with only 500 qualified leads—nowhere near the volume needed to run effective outbound. They even tried niche data providers. Still, the results were either duplicates, stale, or completely off-target. Conduit was stuck. Until they found Sixtyfour. #### How Sixtyfour Cracked the Code At Sixtyfour, our AI agents are trained to find the kind of businesses that don’t show up on conventional databases. We have access to proprietary data and are designed to pull insights from every possible public source. Within two weeks of working together, we helped Conduit do what no other vendor could: identify every Guesty, HostAway, and RentManager customer on the market. Let’s break it down for just Guesty: - BuiltWith results: ~728 leads, only ~400–500 qualified. - Sixtyfour results: 8,000+ Guesty customers, with over 3,000 matching Conduit’s ICP, meaning companies with 25+ listings. That’s a 10x leap in lead volume—and far higher quality. #### The Enrichment Advantage The next challenge: even with account names, traditional enrichment tools couldn’t surface real contact information. Conduit tried running the list through Apollo and only got contact data for about 25% of the accounts. Using Sixtyfour's enrichment API, we were able to surface verified leads for over 75% of those accounts—including many hard-to-find international businesses where the only mention of the owner might be buried in some obscure PDF or a two-year-old press article. #### The Outcome With high-quality leads flowing into their pipeline, Conduit is now on track to grow faster than ever before. They estimate: - 30% month-over-month revenue growth. - 3x growth over the next year. By removing the biggest friction in their sales process—finding the right customers—Conduit is now free to focus on what they do best: building intelligent agents that automate away the headaches of property management. This is exactly why we built Sixtyfour—to help companies find the hard-to-find. If you’re targeting niche, fragmented, or global markets that traditional tools can’t reach, let’s talk. Because if the data exists on the internet, we’ll find it. --- ### Case study: how Whatnot found European TCG sellers *How Sixtyfour helped Whatnot identify qualified TCG sellers across the UK, Netherlands, and France for live auction commerce.* Source: https://www.sixtyfour.ai/blog/case-study-how-whatnot-discovered-european-tcg-sellers-with-sixtyfour Christopher Price · 2026-02-11 · Company #### The Problem Whatnot needed to find TCG sellers in the UK, Netherlands, and France who could anchor live auction streams. Not just any sellers, but ones with established audiences, consistent inventory, and proven selling ability. Many doubted such sellers existed in these markets at scale. The assumption was that international TCG commerce happened primarily through local shops and traditional marketplaces, not social media. Finding social media creators who were also serious card sellers seemed unlikely, especially outside major cities. #### What Whatnot Does with Sixtyfour Sixtyfour proved the sellers existed. The platform identified social media accounts across Europe that showed Pokemon, Magic, and other TCG content, then recursively researched each one to determine commercial viability. From a single seller handle, Sixtyfour's agents would uncover the complete seller profile: their eBay store showing monthly transaction volume, their TILT link revealing all selling channels, their Instagram with business contact information, their participation in card grading services. The agents distinguished between casual collectors making content and serious sellers moving real volume. This recursive research transformed sparse social media presence into actionable intelligence. A Dutch social media account with 3,000 followers might turn out to be moving €10,000 monthly in graded Pokemon cards. A French creator doing pack openings might have a warehouse full of vintage inventory. These sellers existed, but only comprehensive research could identify them. Whatnot's AEs used Sixtyfour's agents to generate pre-qualified lists with complete profiles: verified sales history, inventory depth, audience metrics, and direct contact information. Every account found was exactly who Whatnot needed to bring to the platform. #### Results Sixtyfour identified hundreds of qualified TCG sellers across European social media that no one believed existed at this scale. The platform found serious card sellers in Netherlands suburbs, vintage Pokemon dealers in French cities, and Magic the Gathering specialists throughout the UK, all with existing social audiences ready for live commerce. What seemed impossible to find manually, Sixtyfour delivered systematically. Whatnot could enter European markets knowing exactly which sellers to recruit, with all the context needed to close them. --- ### Sixtyfour AI is now backed by Y Combinator *Sixtyfour AI is joining Y Combinator’s first-ever spring batch as we go all in on building the best AI research platform in the world.* Source: https://www.sixtyfour.ai/blog/sixtyfour-ai-is-now-backed-by-y-combinator Saarth Shah · 2025-04-02 · Company #### What is Y Combinator? Y Combinator is the world’s most selective startup accelerator, with an acceptance rate under 1%. Since 2005, YC has funded over 5,000 companies—including Airbnb, Dropbox, Stripe, and Coinbase—whose combined portfolio valuation now exceeds $800 billion. But YC’s real power is in the community. The alumni network is one of the strongest out there, filled with some of the most ambitious and impactful founders in the world. #### What YC Means to Us Between the two of us, Chris and I had applied to YC 10 times. We were always close—never quite made it. I first applied as a freshman in college, full of energy but nowhere near ready. I actually heard about YC back in middle school in India. To me, it symbolized the American Dream. Over the years, we tried dozens of ideas, worked at YC companies, and kept learning. We never gave up, even when it felt like we were always one step away. This time, it just clicked and we are beyond excited to be part of YC’s first-ever spring batch. #### How Sixtyfour AI Started Sixtyfour started like most good ideas do—half out of frustration, half out of curiosity. It was January. I was at Whatnot (YC W20), and Chris had just taken time off from school. We’d both built startups before, and we knew how painful customer discovery was. Identifying the right leads felt broken. So much of it relied on tedious, manual research. We had a hunch: what if we could automate that grind? On our very first call, one of our friends—a founder at a VC-backed startup—paid us to help them find individual psychiatrists in specific geographies. That’s when it clicked: tools like Apollo and ZoomInfo didn’t have solid data on niche, local businesses. Building those lead lists meant scraping directories and manually verifying info online. So we hacked together a prototype that could run “deep research” on any business or person—pulling together everything publicly available. It worked. Within weeks, we helped that customer generate ~$5,000 in new revenue, with only $300 in costs on our end. We weren’t making money yet, but the signal was clear: this was valuable. From there, we started aiming higher—going after companies with larger deal sizes and more complex workflows. That’s where our product really shines. Right around then, the YC interview email landed—midway through a customer call. Twelve hours later, Chris had flown in from Texas and was crashing on my floor in Berkeley. We walked out of the interview thinking we bombed it. Two days later, we were apartment-hunting in San Francisco, and I had submitted my resignation at Whatnot. We were in. #### The Road Ahead Now with YC behind us, we’re going all in on building the best AI Research platform in the world. It started with an enrichment API. Today, it’s become a full-blown research engine that can surface intel on nearly any person or business. We might be the only platform that can reliably identify tiny, obscure businesses—ones with just a couple employees in some corner of the world—and pull up real, actionable contact info. If it exists online, we can find it. In the last two months alone, we’ve grown revenue 20x. But more importantly, we’re generating serious pipeline for our customers—and seeing even more value being built on top of our API. And that’s just the beginning. One use case we’re especially hyped about: finding every customer of legacy software companies. With vertical AI startups rapidly disrupting these niches, that data is turning out to be gold. If that’s something you’re working on, we’d love to talk. #### Thank You We wouldn’t be here without the early believers—our first customers, friends, and mentors who took a bet on us when all we had was a scrappy prototype and a strong conviction. We’re still that same team, two founders who just wanted to build something useful—something people want and love. And we’re more excited than ever. Thank you to everyone who’s been part of the journey so far. We’re just getting started. #### Building something that needs better sales intelligence? We’d love to help—reach out here or DM me on Twitter. --- ## Solutions ### Financial Institutions https://www.sixtyfour.ai/solutions/financial-institutions Follow the business. Find the people behind it. Go deeper on the customers that need a closer look. Connect a business to its owners, its online footprint and the evidence your team needs to review. A registry entry is only the beginning. A registered business can still leave important questions unanswered. Does its online activity support what it says it does? Who is connected to it? Which adverse findings actually refer to the same subject? Sixtyfour researches across sources so analysts can work from a fuller picture. #### KYB investigations Research an unfamiliar merchant’s operating footprint and connected people when the application needs more context. #### Beneficial ownership research Follow ownership and directorship records across entities, with the source behind each connection. #### Enhanced due diligence Bring public records, adverse media and unresolved questions together for a deeper customer review. The relationship matters. So does the source. Give reviewers the underlying record, the reason it may relate to the subject and the questions that remain open. Sixtyfour adds investigative context to your existing screening and case review process. #### Where does Sixtyfour fit in our KYB workflow? Use it when a business or connected person needs deeper research. Start with the identifiers you already have, investigate the open questions, then review the cited findings alongside your existing checks. #### Can analysts inspect the evidence? The research is source-cited, so reviewers can examine the records behind findings. Identity matches and incomplete information still need analyst judgment. #### Is this transaction monitoring or a complete AML system? This page describes identity and company investigation. Discuss your existing screening, monitoring and case-management tools with us so we can show where Sixtyfour fits. ### Workforce identity https://www.sixtyfour.ai/solutions/workforce-identity Know who’s behind the application. A convincing résumé is a starting point. Research the identity behind it, compare the claims with public evidence, and give your team better questions before the interview. The interview starts after the identity story. A constructed identity can arrive with polished credentials and a confident interview. Research the professional footprint behind the application: when it appeared, what corroborates it, and where the story conflicts. A missing record is a question to resolve, not a verdict. #### Candidate fraud research Investigate identity inconsistencies and fabricated history before investing more time in an application. #### Contractor verification Understand the person behind a contractor profile using the identifiers and claims your team already has. #### Platform integrity Research suspicious overlaps between worker profiles and investigate possible identity reuse. Already part of the hiring conversation. Casco uses Sixtyfour to flag adverse media and résumé inaccuracies before getting on a call. The workflow starts with research that hiring and security teams can review together. #### Does a limited online presence mean a candidate is fake? No. Privacy choices, career changes and uneven source coverage can all produce a limited footprint. Missing evidence should remain unresolved and be considered with other information and the candidate’s explanation. #### Does this replace employment background screening? Sixtyfour provides identity research and supporting evidence. Use it within your established hiring review process, alongside any required screening, consent and candidate review procedures. #### Can we investigate contractors as well as employees? Yes. The research can start from a contractor’s known identifiers and professional claims. Our team can help map the output to the questions your reviewers need answered. ### Investigations https://www.sixtyfour.ai/solutions/investigations Start with a lead. See where it connects. Resolve the identity behind an identifier. Research aliases, public records and connected entities, then follow the evidence into the next question. A lead rarely arrives as a complete profile. An investigation might begin with a username, an email address or a company mentioned in a report. Sixtyfour researches across sources and organizes the relevant identities and connections, giving investigators a starting point they can inspect and build on. #### Identity resolution Research the person or entity behind a partial identifier, with evidence for possible matches. #### Relationship mapping Explore links between aliases, companies and records to identify connections worth investigating. #### Case development Bring new leads into an existing investigation and keep the underlying source context close to the finding. Every connection should invite inspection. A graph is useful when you can explain its edges. Sixtyfour pairs identity research with source context so investigators can distinguish a direct link, a possible match and a question that remains open. #### What can an investigation start from? Start with a known identifier such as a name, email address, phone number, username or company. Adding reliable context helps distinguish the subject from similar matches. #### Are all discovered connections confirmed? No. Shared names and reused handles can produce false matches. Inspect the supporting evidence and treat ambiguous links as leads until corroborated. #### Does Sixtyfour make a determination of criminal activity? No. The research supports investigators by surfacing evidence and possible connections. Determinations and further investigative steps remain with the responsible team. ### Research API https://www.sixtyfour.ai/solutions/research-api Your questions. Our research. One API. Turn a person or company identifier into structured intelligence. Define what you need to know, choose the depth of research, and build the findings into your own workflow. Ask for the fields your workflow actually needs. Fixed datasets answer the questions someone else chose. Sixtyfour lets you define a research schema for a person or company, so you can request the context your product needs and receive it in a structured response. #### People intelligence Research professional history, public profiles and other requested attributes from a known identity. #### Company intelligence Investigate a business and the people connected to it using a custom research schema. #### Async & bulk research Run longer jobs asynchronously or process batches through the documented bulk endpoints. A small request. A specific research brief. The schema is the brief. Replace the subject and field descriptions with the information your workflow needs. Keep your API key on your server. #### Is the schema fixed? No. The struct object describes the fields you want the agents to research. Write clear descriptions for each field and validate the response in your application. #### How do I choose a research tier? The API supports different research depths. Start with the documented default and compare results on representative subjects. Higher tiers perform deeper research; high-tier intelligence requires enterprise access. See the docs for current access and pricing. #### Can I process a batch of records? Yes. Dedicated bulk intelligence endpoints accept CSV, JSON and NDJSON uploads. They return a task identifier so your application can track the background job. #### Where should I put my API key? Make authenticated calls from your server. Do not embed the key in client-side JavaScript or public repositories. The quick start documents the x-api-key header. ### Child Safety https://www.sixtyfour.ai/solutions/child-safety More context behind a reported account. Give specialist reviewers a clearer picture of the identity behind an account. Research connected aliases and available age evidence, with sources and uncertainty kept in view. The report is one part of the picture. Safety teams may need to understand who is behind an account and whether it connects to other relevant identities. Sixtyfour supports that research with source-cited findings, helping specialists distinguish known information from leads that need further review. #### Account identity research Expand a reported identifier into relevant public context for a specialist investigation. #### Alias and relationship research Investigate possible connections between accounts, with the supporting details available for review. #### Age evidence research Use the documented age-verification endpoint to research a date of birth or grounded estimate, with evidence and confidence where available. Clarity includes what the research cannot establish. Identity research supports the team reviewing a case. Findings should preserve ambiguity, source gaps and possible false matches. Content assessment, enforcement and escalation stay within your specialist safety process. #### Does this page describe harmful-content detection? No. The workflow here is identity research: understanding account identifiers, possible aliases and available age evidence. It complements the specialist tools and processes your team uses for content review. #### Can an age always be established? No. The age-verification endpoint researches public evidence for a date of birth or grounded estimate. Availability varies, and unresolved or low-confidence results need an appropriate next step in your existing process. #### Does an identity match trigger enforcement? No. A possible match is research for specialist review. Your team assesses the sources, applies platform policy and decides on any further action.